CompTIA SecurityX (formerly CASP+): key terms

Flashcards for this exam CompTIA SecurityX (formerly CASP+) guide Class dates

• Abuse CaseA description of how a user could intentionally misuse a system's functionality to cause harm, used to derive security requirements and tests.Intermediate
• Access TokenCredential issued by an authorization server that a client presents to an API to access protected resources.Intermediate
• Address Space Layout Randomization (ASLR)An OS exploit mitigation that randomizes where code, stack, heap and libraries are loaded in memory.Intermediate
• AddressSanitizer (ASan)A compiler-based runtime memory error detector that finds buffer overflows, use-after-free and similar bugs during testing.Advanced
• AFL++A widely used open-source coverage-guided fuzzer, the community-maintained successor to American Fuzzy Lop.Advanced
• Allowlist ValidationInput validation that accepts only values matching a known-good pattern or set and rejects everything else.Foundational
• Anti-Rollback ProtectionA mechanism that prevents installing older, vulnerable firmware or software versions after an update.Advanced
• API DiscoveryAutomatically identifying an organization's APIs and endpoints from traffic, gateways, code and cloud configurations.Intermediate
• Application InventoryA maintained catalog of an organization's applications, APIs and components with owners, data classification and risk ratings.Foundational
• Application Security ProgramThe organizational structure, policies, tools and processes that manage security risk across an organization's software portfolio.Intermediate
• Argon2Memory-hard password hashing function that won the 2015 Password Hashing Competition; Argon2id is recommended.Advanced
• Asymmetric EncryptionEncryption using a mathematically related key pair: a public key to encrypt or verify and a private key to decrypt or sign.Foundational
• Attack SurfaceThe total set of points where an unauthorized user could try to enter or extract data from a system.Foundational
• Attack Surface AnalysisIdentifying and assessing all the points where an attacker could interact with or send input to an application.Foundational
• Attack TreeA hierarchical diagram with an attacker's goal at the root and the alternative ways to achieve it as child nodes.Intermediate
• AttestationProcess by which a device or workload provides cryptographic evidence of its identity and integrity to a verifier.Advanced
• Attribute-Based Access Control (ABAC)Access control model that evaluates attributes of the subject, object, action, and environment against policies.Intermediate
• Authenticated Encryption with Associated Data (AEAD)Encryption that provides confidentiality, integrity, and authenticity, while also authenticating unencrypted header data.Advanced
• Authenticator Assurance Level (AAL)NIST SP 800-63B rating (AAL1-AAL3) of confidence that the person authenticating controls the account's authenticators.Advanced
• Authorization Code FlowOAuth grant where the client receives a short-lived code via the browser and exchanges it server-side for tokens.Advanced
• Automated Certificate Management Environment (ACME)Protocol (RFC 8555) that automates domain validation, issuance, and renewal of certificates.Intermediate
• Banned FunctionsUnsafe library functions that a secure coding standard prohibits because they commonly cause vulnerabilities.Intermediate
• Bell-LaPadula Model (BLP)Formal confidentiality model enforcing 'no read up, no write down' using security labels.Advanced
• Biba ModelFormal integrity model enforcing 'no read down, no write up' to prevent corruption of higher-integrity data.Advanced
• BootkitA rootkit that infects the boot process, such as the MBR, VBR or UEFI firmware, to load before the operating system.Advanced
• Breach and Attack Simulation (BAS)Automated platforms that continuously run safe simulated attacks to validate whether security controls detect and block them.Intermediate
• Brewer-Nash ModelAccess control model, also called the Chinese Wall, that prevents conflicts of interest by restricting access dynamically.Advanced
• Broken Object Level Authorization (BOLA)API1:2023, failure to verify that the caller is authorized to access the specific object identified in a request.Foundational
• Build ProvenanceVerifiable metadata describing how, where, when and from what sources a software artifact was built.Advanced
• Building Security In Maturity Model (BSIMM)A descriptive software security maturity model built from observing the real practices of participating organizations.Advanced
• CA/Browser ForumIndustry body of certificate authorities and browser/OS vendors that sets rules for publicly trusted certificates.Advanced
• CanonicalizationConverting data to its standard, simplest form before validating or using it.Intermediate
• Cardholder Data Environment (CDE)People, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, plus connected systems.Intermediate
• Certificate Lifecycle Management (CLM)Processes and tools to discover, issue, deploy, renew, and revoke certificates across an organization.Intermediate
• Certificate LifetimeThe validity period of a certificate, between its notBefore and notAfter dates.Intermediate
• Certificate PinningAssociating a host with an expected certificate or public key so other valid-looking certificates are rejected.Advanced
• Certificate Transparency (CT)Public, append-only logs of issued TLS certificates that let anyone monitor which certificates exist for a domain.Intermediate
• Certification Practice Statement (CPS)Document describing how a CA operates and implements its certificate policy.Advanced
• ChaCha20-Poly1305AEAD algorithm combining the ChaCha20 stream cipher with the Poly1305 authenticator, standardized in RFC 8439.Advanced
• Chain of TrustSequence of certificates from an end-entity certificate through intermediates to a trusted root CA.Foundational
• Cipher Block Chaining (CBC)Block cipher mode in which each plaintext block is XORed with the previous ciphertext block before encryption.Intermediate
• Cipher SuiteNamed combination of algorithms used by TLS for key exchange, authentication, bulk encryption, and hashing.Intermediate
• CISA Zero Trust Maturity Model (ZTMM)CISA framework describing zero trust progress across five pillars and four maturity stages.Advanced
• Clark-Wilson ModelCommercial integrity model using well-formed transactions and separation of duties to protect data.Advanced
• Client to Authenticator Protocol (CTAP)FIDO protocol for communication between a client device and an external authenticator over USB, NFC, or Bluetooth.Advanced
• Client-Side ValidationInput checks performed in the browser or mobile app before data is sent to the server.Foundational
• Cloud Access Security Broker (CASB)Security policy enforcement point between users and cloud services that provides visibility, compliance, data security and threat protection.Intermediate
• Code SigningDigitally signing software so users and systems can verify its publisher and that it has not been modified.Foundational
• Code Signing CertificateCertificate used to digitally sign software so users can verify its publisher and integrity.Intermediate
• Code Signing TimestampA trusted timestamp applied to a code signature so it remains valid after the signing certificate expires.Advanced
• Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)NSA's quantum-resistant algorithm suite and transition timeline for US national security systems.Advanced
• Common Attack Pattern Enumeration and Classification (CAPEC)MITRE's catalog of common attack patterns describing how adversaries exploit known weaknesses.Intermediate
• Common Criteria (CC)International standard (ISO/IEC 15408) for evaluating the security of IT products against defined requirements.Advanced
• Common Vulnerability Scoring System (CVSS)An open standard for rating the severity of vulnerabilities on a 0.0 to 10.0 scale, maintained by FIRST.Foundational
• Common Weakness Enumeration (CWE)A community-developed catalog of software and hardware weakness types, maintained by MITRE.Intermediate
• Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
• Compiler Hardening FlagsCompiler and linker options that add exploit mitigations and stricter checks to built binaries.Advanced
• Complete MediationDesign principle that every access to every object must be checked for authorization every time.Intermediate
• Compliance-Based Penetration TestingPenetration testing performed to satisfy a regulatory or standards requirement, such as PCI DSS or FedRAMP.Intermediate
• Confidential ComputingProtection of data in use by performing computation in hardware-based, attested trusted execution environments.Advanced
• Container EscapeBreaking out of a container's isolation to gain access to the host or other containers.Advanced
• Container Image HardeningBuilding container images with minimal contents, non-root users and no secrets to reduce attack surface.Intermediate
• Content Security Policy (CSP)An HTTP response header that tells browsers which sources of scripts, styles and other content are allowed, mitigating XSS and data injection.Intermediate
• Continuous Automated Red Teaming (CART)Automated, ongoing simulation of attacker reconnaissance and attack paths against an organization's external attack surface.Advanced
• Continuous Integration SecurityProtecting CI/CD systems, runners, secrets and pipeline definitions from tampering and misuse.Intermediate
• Control-Flow Integrity (CFI)A mitigation that restricts indirect calls and jumps to valid targets determined at compile time, blocking control-flow hijacking.Advanced
• Coordinated Vulnerability Disclosure (CVD)A disclosure model where a researcher privately reports a flaw and publication is delayed until the vendor can release a fix.Intermediate
• Counter Mode (CTR)Block cipher mode that encrypts a nonce-plus-counter value and XORs the result with plaintext, acting like a stream cipher.Advanced
• Coverage-Guided FuzzingFuzzing that uses instrumentation feedback about which code paths were executed to prioritize inputs that reach new code.Advanced
• Covert ChannelUnauthorized communication path that transfers information in a way that violates security policy.Advanced
• Cross-CertificationEstablishing trust between separate PKI hierarchies by having CAs sign each other's certificates.Advanced
• Cryptographic AgilityAbility to replace cryptographic algorithms, keys, and parameters quickly without major system redesign.Advanced
• Cryptographic Bill of Materials (CBOM)Inventory of cryptographic assets, algorithms, keys, certificates, and libraries used by a system.Advanced
• Cryptographic FailuresOWASP Top 10 category for failures to protect data with appropriate cryptography, formerly called Sensitive Data Exposure.Foundational
• Cryptographically Relevant Quantum Computer (CRQC)A quantum computer powerful enough to break widely used public key cryptography such as RSA and ECC.Advanced
• Cryptographically Secure Pseudorandom Number Generator (CSPRNG)Random number generator whose output is unpredictable enough for cryptographic use.Advanced
• Curve25519Elliptic curve designed by Daniel Bernstein for fast, safe Diffie-Hellman key agreement (X25519).Advanced
• CVSS v4.0The 2023 version of CVSS that adds Attack Requirements, splits impact into vulnerable and subsequent systems and renames Temporal to Threat metrics.Advanced
• CWE Top 25MITRE's annually updated ranking of the most dangerous software weaknesses, based on CVE data, severity and exploitation.Intermediate
• Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)2022 US law directing CISA to require critical infrastructure entities to report covered cyber incidents and ransom payments.Advanced
• Cyber-Physical System (CPS)A system that integrates computing, networking and physical processes so that digital actions have physical effects.Intermediate
• Cybersecurity Supply Chain Risk Management (C-SCRM)Practices to identify, assess, and mitigate cybersecurity risks throughout the supply chain of products and services.Intermediate
• CycloneDXAn OWASP SBOM standard (ECMA-424) designed for security use cases, supporting software, hardware, services, cryptographic assets and VEX data.Intermediate
• Data ClassificationCategorizing data by sensitivity and value to determine required protection and handling.Foundational
• Data Execution Prevention (DEP)A mitigation that marks memory regions such as the stack and heap as non-executable, using the CPU's NX/XD bit.Intermediate
• Data HistorianA database that collects and stores time-series process data from industrial control systems for analysis and reporting.Intermediate
• Data in UseData actively being processed in memory or by a CPU, which is typically unencrypted during computation.Intermediate
• Data Loss Prevention (DLP)Technology that detects and blocks unauthorized transmission or storage of sensitive data.Foundational
• DeepfakeSynthetic audio, video or images generated with AI to convincingly impersonate a real person.Intermediate
• Denylist ValidationInput validation that rejects values matching known-bad patterns and accepts everything else.Foundational
• Dependency ConfusionA supply chain risk in which a package manager installs a malicious public package instead of an internal private package with the same name.Intermediate
• Device Posture CheckEvaluating a device's security state, such as patch level, encryption, and EDR status, before granting access.Intermediate
• Diamond Model of Intrusion AnalysisAn analytic model describing every intrusion event by four core features: adversary, capability, infrastructure and victim.Intermediate
• Diffie-Hellman (DH)Key agreement protocol that lets two parties derive a shared secret over an insecure channel.Foundational
• Digital SignatureCryptographic value created with a private key over a message hash that proves origin, integrity, and non-repudiation.Foundational
• Distributed Control System (DCS)A process control system in which controllers are distributed throughout a single plant or facility under centralized supervision.Intermediate
• DNP3Distributed Network Protocol 3, an industrial protocol used mainly in electric and water utilities for communication between SCADA masters, RTUs and IEDs.Intermediate
• DNS over HTTPS (DoH)Encrypting DNS queries inside HTTPS on TCP 443 to provide privacy from on-path observers.Intermediate
• Double FreeCalling free on the same memory twice, which can corrupt the heap allocator and enable code execution.Advanced
• DREADA threat risk-rating model scoring Damage, Reproducibility, Exploitability, Affected users and Discoverability.Intermediate
• Dual ControlRequiring two or more authorized people to act together to perform a sensitive operation.Intermediate
• Dynamic SecretsCredentials generated on demand for each client with a short lease, then automatically revoked.Advanced
• Economy of MechanismSaltzer and Schroeder principle that security designs should be as simple and small as possible.Intermediate
• Edwards-curve Digital Signature Algorithm (EdDSA)Deterministic signature scheme on twisted Edwards curves, most commonly Ed25519.Advanced
• Egress FilteringRestricting outbound network traffic from systems to only approved destinations and protocols.Intermediate
• Electronic Codebook (ECB)Block cipher mode that encrypts each block independently, so identical plaintext blocks yield identical ciphertext.Intermediate
• Elliptic Curve Cryptography (ECC)Public key cryptography based on elliptic curve math, offering strong security with short keys.Intermediate
• Elliptic Curve Diffie-Hellman (ECDH)Diffie-Hellman key agreement performed with elliptic curve groups, providing equal security with smaller keys.Intermediate
• Elliptic Curve Digital Signature Algorithm (ECDSA)Digital signature algorithm using elliptic curve cryptography, standardized in FIPS 186-5.Intermediate
• Embedded System SecurityProtecting purpose-built computing devices with constrained resources, often running real-time operating systems and long-lived firmware.Intermediate
• Engineering Workstation (EWS)A computer used by control engineers to configure, program and troubleshoot PLCs, DCS controllers and other ICS devices.Intermediate
• Enterprise Access ModelMicrosoft model separating access into control, management, data/workload, and user/app access planes, replacing the legacy tier model.Advanced
• Enterprise Security ArchitectureStructured design of security controls, processes, and technologies aligned to an organization's business goals and risks.Intermediate
• Ephemeral KeyA key generated for a single session or transaction and discarded afterward.Intermediate
• ETSI EN 303 645A European standard setting baseline cybersecurity provisions for consumer IoT devices.Advanced
• Executive Order 14028The May 2021 U.S. order 'Improving the Nation's Cybersecurity' that drove federal SBOM and secure development attestation requirements.Intermediate
• Exploit Prediction Scoring System (EPSS)A FIRST data-driven model estimating the probability that a CVE will be exploited in the wild within the next 30 days.Intermediate
• External Attack Surface Management (EASM)Continuous discovery and monitoring of an organization's internet-facing assets as an attacker would see them.Intermediate
• Fail-Safe DefaultsBase access decisions on explicit permission rather than exclusion, so the default is no access.Intermediate
• Federal Information Processing Standard 140-3 (FIPS 140-3)US/Canadian standard for validating cryptographic modules at four increasing security levels.Advanced
• FIDO2FIDO Alliance and W3C standard for phishing-resistant, public key-based passwordless authentication.Intermediate
• Firmware AnalysisExamining device firmware images to find vulnerabilities, hard-coded secrets, outdated components and insecure configurations.Advanced
• FN-DSAFFT over NTRU-Lattice-Based Digital Signature Algorithm, NIST's Falcon-based post-quantum signature standard (FIPS 206).Advanced
• Four Question FrameworkAdam Shostack's threat modeling structure: What are we working on, what can go wrong, what are we going to do about it, and did we do a good job?Intermediate
• Fuzz TestingAn automated testing technique that feeds large volumes of malformed, unexpected or random input to a program to find crashes and bugs.Foundational
• Galois/Counter Mode (GCM)Authenticated block cipher mode combining counter mode encryption with Galois field authentication (GHASH).Intermediate
• Generation-Based FuzzingFuzzing that builds test inputs from a model, grammar or specification of the expected input format.Intermediate
• Grover's AlgorithmQuantum search algorithm offering a quadratic speedup that effectively halves symmetric key and hash security.Advanced
• Hamming Quasi-Cyclic (HQC)Code-based key encapsulation mechanism selected by NIST in March 2025 as a backup to ML-KEM.Advanced
• Hard-Coded CredentialsPasswords, API keys or cryptographic keys embedded directly in source code, scripts or binaries.Foundational
• Hardware Debug InterfacePhysical interfaces such as JTAG, SWD and UART used during development that can expose device memory, firmware and consoles.Advanced
• Hardware Security Module (HSM)Tamper-resistant hardware device that generates, stores, and uses cryptographic keys without exposing them.Foundational
• Harvest Now, Decrypt Later (HNDL)Strategy of collecting encrypted data today to decrypt it once a quantum computer can break the encryption.Advanced
• Hash-Based Message Authentication Code (HMAC)MAC construction that combines a cryptographic hash function with a secret key (RFC 2104).Intermediate
• HashiCorp VaultA secrets management tool that stores static secrets, generates dynamic credentials, and provides encryption as a service.Intermediate
• Heap-Based Buffer OverflowWriting beyond the bounds of memory allocated on the heap, corrupting adjacent data or allocator metadata.Advanced
• Hold Your Own Key (HYOK)Model where encryption keys remain in customer-controlled systems outside the cloud provider at all times.Advanced
• Homomorphic EncryptionEncryption that allows computation on ciphertext, producing encrypted results that decrypt to the correct answer.Advanced
• HTTP Strict Transport Security (HSTS)HTTP response header instructing browsers to connect to a site only over HTTPS for a set time.Intermediate
• Human-Machine Interface (HMI)The software and screens operators use to view process status and issue commands to an industrial control system.Foundational
• Hybrid Key ExchangeCombining a classical and a post-quantum key exchange so the session is secure if either algorithm holds.Advanced
• ID TokenOIDC JSON Web Token that asserts the identity of the authenticated user to the client application.Advanced
• Identity Governance and Administration (IGA)Discipline and tools for managing identity lifecycle, access requests, certifications, and policy compliance.Advanced
• Identity ProofingVerifying that a person is who they claim to be before issuing credentials.Intermediate
• IEC 62443The ISA/IEC series of standards for cybersecurity of industrial automation and control systems (IACS), covering asset owners, integrators and product suppliers.Intermediate
• IEC 62443 Security Levels (SL)Four security levels in IEC 62443 describing the capability required to protect against increasingly capable attackers.Advanced
• IEC 62443-4-1The part of IEC 62443 that specifies secure product development lifecycle requirements for suppliers of industrial automation components.Advanced
• Implicit Trust ZoneArea behind a policy enforcement point where entities are trusted to the last enforcement check.Advanced
• in-totoA framework (a CNCF graduated project) for securing software supply chains by creating signed attestations of each step and verifying them end to end.Advanced
• Industrial Control System (ICS)A general term for control systems (SCADA, DCS, PLC-based systems) used to operate industrial processes.Foundational
• Industrial DMZ (IDMZ)A buffer network between enterprise IT and OT networks that brokers all data exchange so no traffic flows directly between them.Intermediate
• IndustroyerMalware used in the December 2016 attack that caused a power outage in Kyiv, Ukraine, by directly speaking grid control protocols.Advanced
• Infrastructure as Code ScanningStatic analysis of Terraform, CloudFormation, Kubernetes manifests, Helm charts and similar templates for security misconfigurations before deployment.Intermediate
• Input ValidationChecking that all untrusted input conforms to expected type, length, format and range before it is processed.Foundational
• Insecure DeserializationDeserializing untrusted data in a way that lets an attacker manipulate objects, often leading to remote code execution.Intermediate
• Insecure DesignOWASP Top 10 category for flaws rooted in missing or ineffective security controls at the design level rather than implementation bugs.Intermediate
• Insecure RandomnessUsing a predictable random number generator for security-sensitive values such as tokens, keys or nonces.Intermediate
• Integer OverflowAn arithmetic result that exceeds the maximum value of its integer type and wraps around, often leading to undersized buffers.Advanced
• Interactive Application Security Testing (IAST)Security testing that uses agents instrumented inside a running application to observe code execution and data flow during functional tests.Intermediate
• Intermediate Certificate AuthorityA subordinate CA whose certificate is signed by a root or another intermediate and that issues end-entity certificates.Foundational
• Internet of Things SecurityPractices for protecting connected devices with limited resources, long lifespans, and often weak default security.Intermediate
• JSON Web Token (JWT)A compact, URL-safe token format consisting of a base64url-encoded header, payload of claims, and signature.Intermediate
• Just-in-Time Access (JIT Access)Granting elevated privileges only when needed and only for a limited time, removing standing privileges.Intermediate
• Just-in-Time Provisioning (JIT Provisioning)Creating a user account in an application automatically on first sign-in using attributes from the IdP's assertion.Intermediate
• JWT Claims ValidationChecking a JSON Web Token's standard claims, such as expiry, issuer and audience, in addition to its signature.Intermediate
• KerberosTicket-based network authentication protocol using a trusted KDC and symmetric cryptography.Intermediate
• Kerckhoffs's PrincipleA cryptosystem should remain secure even if everything about it except the key is public knowledge.Intermediate
• Key CeremonyFormal, audited procedure for generating or using high-value keys, such as a root CA key, under multi-person control.Advanced
• Key Derivation Function (KDF)Function that derives one or more cryptographic keys from a secret value such as a password or shared secret.Advanced
• Key Distribution Center (KDC)Kerberos component that authenticates principals and issues tickets, consisting of the AS and TGS.Advanced
• Key Encapsulation Mechanism (KEM)Public key scheme that encapsulates a randomly generated shared secret for a recipient's public key.Advanced
• Key Encryption Key (KEK)A key used to encrypt (wrap) other keys rather than data.Intermediate
• Key LengthThe size of a cryptographic key in bits, which determines the size of the key space and resistance to brute force.Foundational
• Key LifecycleStages a cryptographic key passes through: generation, distribution, storage, use, rotation, archival, and destruction.Intermediate
• Key ManagementPractices and systems for securely generating, distributing, storing, rotating, and destroying cryptographic keys.Foundational
• Key Usage ExtensionX.509 extensions that restrict what a certificate's key may be used for, such as signing or server authentication.Advanced
• Known Exploited Vulnerabilities Catalog (KEV)CISA's authoritative list of vulnerabilities confirmed to be actively exploited in the wild.Intermediate
• Lattice-Based CryptographyCryptography based on hard problems over mathematical lattices, such as learning with errors, believed quantum-resistant.Advanced
• Lightweight CryptographyCryptographic algorithms designed for constrained devices with limited power, memory, and processing.Advanced
• Log InjectionWriting unvalidated user input to logs, allowing forged entries, log parsing exploits or injection into log viewers.Intermediate
• Log4ShellA critical 2021 remote code execution vulnerability (CVE-2021-44228) in Apache Log4j 2 caused by JNDI lookups in logged strings.Foundational
• M of N ControlRequiring any M of N designated custodians to cooperate to perform a sensitive operation.Intermediate
• Malicious PackageAn open-source package intentionally published or modified to perform harmful actions such as stealing credentials or installing backdoors.Intermediate
• Measured BootBoot process that records hashes of each component into the TPM so the boot state can be verified later.Advanced
• Media Access Control Security (MACsec)IEEE 802.1AE standard providing Layer 2 hop-by-hop encryption and integrity on Ethernet links.Advanced
• Memory Tagging Extension (MTE)An ARM hardware feature that tags memory allocations and pointers so mismatched accesses, such as use-after-free or overflows, are detected.Advanced
• Memory-Safe LanguageA programming language that prevents memory errors such as buffer overflows and use-after-free by design.Intermediate
• MicrosegmentationDividing networks into very small, workload-level zones with granular policies controlling east-west traffic.Intermediate
• Microsoft Security Development Lifecycle (SDL)Microsoft's prescriptive secure development process defining security practices from training and requirements through release and response.Intermediate
• Mishandling of Exceptional ConditionsOWASP Top 10 2025 category (A10) for improper error handling, failing open and logic errors under abnormal conditions.Intermediate
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• MITRE D3FENDA MITRE knowledge graph of defensive cybersecurity countermeasures mapped to offensive techniques.Advanced
• ModbusA simple master/slave (client/server) industrial communication protocol created by Modicon in 1979, widely used to read and write PLC registers.Foundational
• Mode of OperationA method that defines how a block cipher repeatedly applies its transformation to encrypt data longer than one block.Intermediate
• Module-Lattice-Based Digital Signature Algorithm (ML-DSA)NIST post-quantum digital signature standard (FIPS 204), derived from CRYSTALS-Dilithium.Advanced
• Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)NIST post-quantum key encapsulation standard (FIPS 203), derived from CRYSTALS-Kyber.Advanced
• Mosca's TheoremRule stating that if data's secrecy lifetime plus migration time exceeds the time to a quantum threat, action is overdue.Advanced
• Mutation-Based FuzzingFuzzing that creates test inputs by randomly modifying valid sample inputs.Intermediate
• Mutual TLS (mTLS)TLS in which both client and server present and verify certificates, providing two-way authentication and encryption.Intermediate
• NERC CIPMandatory North American Electric Reliability Corporation Critical Infrastructure Protection standards for the bulk electric system.Advanced
• NIS2 DirectiveEU Directive (2022/2555) imposing cybersecurity risk-management and incident-reporting obligations on essential and important entities.Intermediate
• NIST IR 8547NIST report setting the timeline to deprecate and then disallow quantum-vulnerable public key algorithms.Advanced
• NIST SP 800-115NIST's Technical Guide to Information Security Testing and Assessment, covering review, target identification and vulnerability validation techniques.Intermediate
• NIST SP 800-82NIST's Guide to Operational Technology Security, providing recommendations for securing ICS and other OT systems.Intermediate
• NISTIR 8259NIST's foundational guidance on cybersecurity activities and capabilities that IoT device manufacturers should provide.Advanced
• Non-repudiationAssurance that a party cannot credibly deny having performed an action, such as sending a message or signing a document.Foundational
• NonceA 'number used once' that ensures uniqueness in a cryptographic operation to prevent replay and keystream reuse.Intermediate
• NT LAN Manager (NTLM)Legacy Microsoft challenge-response authentication protocol, now deprecated in favor of Kerberos.Intermediate
• Null Pointer DereferenceAccessing memory through a pointer whose value is null, typically causing a crash and denial of service.Intermediate
• OAuth 2.0An authorization framework that lets applications obtain limited, delegated access tokens to APIs without handling user passwords.Intermediate
• OAuth Redirect URI ValidationRequiring an exact match between the redirect URI in an OAuth request and the URIs registered for the client.Advanced
• OCSP StaplingTLS feature where the server fetches and attaches a signed OCSP response to its handshake.Intermediate
• Off-by-One ErrorA boundary error where a loop or calculation uses one too many or too few iterations, often overwriting a single byte past a buffer.Advanced
• Offline Root CAA root certificate authority kept powered off or disconnected from networks to protect its private key.Intermediate
• Online Certificate Status Protocol (OCSP)Protocol (RFC 6960) for querying the real-time revocation status of a single certificate.Intermediate
• Open Source License ComplianceEnsuring that use of open-source components follows the obligations of their licenses.Intermediate
• Open Source Security Foundation (OpenSSF)A Linux Foundation project that improves the security of open-source software through tools, standards and best practices.Intermediate
• OpenID Connect (OIDC)Identity layer on top of OAuth 2.0 that authenticates users and returns an ID token.Intermediate
• OpenSSF ScorecardAn automated tool that rates open-source projects on security practices such as branch protection, code review, signed releases and dependency updates.Advanced
• Operational Technology (OT)Hardware and software that monitor and control physical devices, processes and infrastructure, such as in manufacturing, utilities and transportation.Foundational
• OS Command Injection PreventionDefenses that prevent user input from being executed as operating system commands.Intermediate
• Out-of-Bounds ReadReading memory outside the bounds of an allocated buffer, which can leak sensitive data or crash a program.Advanced
• Output EncodingConverting untrusted data into a safe representation for the specific context where it is output, such as HTML, JavaScript, URL or SQL.Foundational
• OWASP API Security Top 10OWASP's list of the ten most critical security risks specific to APIs, last updated in 2023.Foundational
• OWASP Application Security Verification Standard (ASVS)An OWASP standard listing testable security requirements for web applications and services at three verification levels.Intermediate
• OWASP DevSecOps Maturity Model (DSOMM)An OWASP model that defines security activities for DevOps pipelines and rates their implementation across maturity levels.Advanced
• OWASP IoT Top 10OWASP's 2018 list of the top security issues for Internet of Things devices and ecosystems.Foundational
• OWASP Mobile Application Security Verification Standard (MASVS)OWASP's standard of security requirements for mobile apps, organized into control groups and verified with the MASTG.Intermediate
• OWASP Threat DragonAn open-source OWASP threat modeling tool for creating diagrams and recording threats using STRIDE, LINDDUN, CIA and other methods.Intermediate
• OWASP Top 10 CI/CD Security RisksAn OWASP list of the ten most significant security risks in CI/CD environments.Advanced
• Passive OT Network MonitoringMonitoring industrial networks by analyzing copies of traffic, without sending packets to fragile control devices.Intermediate
• PasskeyFIDO2 discoverable credential that replaces passwords, either synced across devices or bound to one device.Intermediate
• Path Traversal PreventionDefenses that stop user input from accessing files outside an intended directory.Intermediate
• Payment Card Industry Data Security Standard (PCI DSS)Industry standard with 12 requirements for protecting payment account data, maintained by the PCI Security Standards Council.Foundational
• PCI DSS Customized ApproachPCI DSS v4 option allowing entities to meet a requirement's stated objective with controls they design, validated by an assessor.Advanced
• Perfect Forward Secrecy (PFS)Property ensuring that compromise of long-term keys does not compromise past session keys.Intermediate
• Personal Identity Verification (PIV)US federal smart card standard (FIPS 201) for employee and contractor identity credentials.Intermediate
• Phishing-Resistant MFAMFA methods that cannot be relayed or tricked into authenticating to a fake site, such as FIDO2 or PKI.Intermediate
• Pointer Authentication (PAC)An ARM architecture feature that signs pointers such as return addresses with a cryptographic code and verifies them before use.Advanced
• Poisoned Pipeline Execution (PPE)A CI/CD risk in which an attacker who can modify pipeline configuration or build scripts gets malicious commands executed by the build system.Advanced
• Policy Decision Point (PDP)Zero trust component that evaluates access requests against policy and decides whether to grant them.Advanced
• Policy Enforcement Point (PEP)Zero trust component that enables, monitors, and terminates connections between subjects and resources as directed by the PDP.Advanced
• Post-Quantum Cryptography (PQC)Classical cryptographic algorithms designed to resist attacks by both classical and quantum computers.Intermediate
• Principle of Least FunctionalityConfiguring systems to provide only essential capabilities and disabling unneeded ports, protocols, and services.Intermediate
• Privileged Access Management (PAM)Controls and tools that secure, monitor, and limit use of administrative and other privileged accounts.Intermediate
• Privileged Access Workstation (PAW)Hardened, dedicated device used only for administrative tasks to protect privileged credentials.Advanced
• Privileged ContainerA container run with all host capabilities and device access, effectively removing isolation from the host.Intermediate
• Process for Attack Simulation and Threat Analysis (PASTA)A seven-stage, risk-centric threat modeling methodology that aligns technical threats with business objectives.Intermediate
• Programmable Logic Controller (PLC)A ruggedized industrial computer that reads inputs from sensors and controls outputs to machinery according to a stored program.Foundational
• Proof Key for Code Exchange (PKCE)OAuth extension (RFC 7636) that binds an authorization code to the client that requested it.Advanced
• Protocol FuzzingFuzzing network protocol implementations by sending malformed or out-of-sequence messages.Advanced
• Public Key Cryptography Standards (PKCS)Set of standards originally published by RSA Laboratories for public key cryptography formats and operations.Advanced
• Public Key Infrastructure (PKI)Framework of CAs, policies, and technology for issuing, managing, and revoking digital certificates.Foundational
• Purdue ModelThe Purdue Enterprise Reference Architecture, a layered model that segments industrial networks from physical processes up to enterprise IT.Foundational
• Quantum Key Distribution (QKD)Method that uses quantum properties of photons to distribute keys with eavesdropping detection.Advanced
• Race ConditionA flaw where the outcome depends on the timing of events, allowing attackers to exploit the gap between operations.Advanced
• Reachability AnalysisDetermining whether vulnerable code in a dependency is actually called by the application, to prioritize SCA findings.Advanced
• Refresh TokenLong-lived OAuth credential used to obtain new access tokens without re-prompting the user.Advanced
• Refresh Token RotationIssuing a new refresh token each time one is used and invalidating the previous one, to limit the value of stolen tokens.Advanced
• Remote Terminal Unit (RTU)A field device that interfaces sensors and equipment at remote sites with a SCADA master, often over long-distance communications.Intermediate
• Reproducible BuildA build process that produces bit-for-bit identical output from the same source, allowing anyone to verify that a binary matches its source.Advanced
• Requirements Traceability Matrix (RTM)A table that maps each requirement to its design elements and test cases to show it is implemented and verified.Intermediate
• Return-Oriented Programming (ROP)A code-reuse exploitation technique that chains short existing instruction sequences ending in return instructions to bypass non-executable memory.Advanced
• Risk-Based AuthenticationAdjusting authentication requirements dynamically based on the calculated risk of each sign-in.Intermediate
• Rivest-Shamir-Adleman (RSA)Asymmetric algorithm based on the difficulty of factoring large integers, used for encryption and digital signatures.Foundational
• Root Certificate Authority (Root CA)The top-level CA in a hierarchy whose self-signed certificate is the trust anchor for all subordinate certificates.Foundational
• Root of Trust (RoT)Inherently trusted hardware or firmware component from which a chain of trust is built.Intermediate
• Runtime Application Self-Protection (RASP)Security technology embedded in an application's runtime that detects and blocks attacks in real time using application context.Intermediate
• Runtime Container SecurityMonitoring running containers and hosts for anomalous or malicious behavior such as unexpected processes, file changes or network connections.Advanced
• Safety Instrumented System (SIS)An independent control system that brings an industrial process to a safe state when dangerous conditions are detected.Advanced
• Saltzer and Schroeder Design PrinciplesEight classic secure design principles from 1975 that underpin modern secure software design.Intermediate
• SAML AssertionSigned XML statement from an IdP containing authentication, attribute, and authorization information about a subject.Advanced
• SBOM Minimum ElementsThe baseline data fields an SBOM must contain, defined by the U.S. NTIA in 2021 and updated by CISA.Advanced
• scryptMemory-hard key derivation function designed to make large-scale hardware password cracking expensive.Advanced
• Secrets ManagementSecurely storing, distributing, rotating, and auditing credentials such as passwords, API keys, and certificates.Foundational
• Secure Access Service Edge (SASE)Cloud-delivered architecture converging SD-WAN networking with security services such as SWG, CASB, ZTNA and FWaaS.Intermediate
• Secure BootUEFI feature that allows only cryptographically signed bootloaders and OS components to run at startup.Intermediate
• Secure by DefaultPrinciple that systems ship with the most secure settings enabled out of the box.Foundational
• Secure by DesignApproach where security is built into a product's architecture and development from the start rather than added later.Intermediate
• Secure Code ReviewManual examination of source code to find security flaws, often focused on high-risk components and guided by checklists and tool output.Foundational
• Secure Coding StandardAn organization's documented rules for writing code that avoids known vulnerability classes.Foundational
• Secure EnclaveIsolated, hardware-protected processor or memory region that handles sensitive data and keys apart from the main OS.Intermediate
• Secure Error HandlingHandling errors and exceptions so the application fails securely, reveals minimal information and logs useful detail internally.Foundational
• Secure Firmware UpdateA device update mechanism that delivers firmware authenticated by digital signature, protected in transit and resistant to rollback.Intermediate
• Secure Hash Algorithm 2 (SHA-2)NIST family of hash functions including SHA-224, SHA-256, SHA-384, and SHA-512.Foundational
• Secure Hash Algorithm 3 (SHA-3)NIST hash standard based on the Keccak sponge construction, standardized in FIPS 202.Intermediate
• Secure Multi-Party Computation (SMPC)Cryptographic technique letting parties jointly compute a function over their inputs without revealing those inputs to each other.Advanced
• Secure Remote Access for OTControlled, monitored remote connectivity for vendors and engineers into industrial environments.Intermediate
• Secure Software Development Attestation FormA CISA form in which software producers attest that they follow key secure development practices derived from NIST SSDF.Advanced
• Secure Software Development Framework (SSDF)NIST SP 800-218, a set of high-level secure software development practices grouped into Prepare, Protect, Produce and Respond categories.Intermediate
• Secure Software Development Life Cycle (SSDLC)A software development life cycle that builds security activities into every phase, from requirements and design through deployment and retirement.Foundational
• Secure Web Gateway (SWG)Security service that filters user web traffic for malware, URL categories, and policy violations.Intermediate
• Security Assertion Markup Language (SAML)XML-based standard for exchanging authentication and authorization data between an IdP and SP.Intermediate
• Security BenchmarkA consensus-based configuration standard specifying secure settings for systems and applications.Intermediate
• Security ChampionA developer or engineer embedded in a product team who acts as the team's security advocate and liaison to the security group.Foundational
• Security Content Automation Protocol (SCAP)A NIST suite of specifications for automating vulnerability management, measurement and compliance checking.Advanced
• Security GateA checkpoint in the SDLC or CI/CD pipeline where defined security criteria must be met before work proceeds.Foundational
• Security Logging and Monitoring FailuresOWASP Top 10 category for insufficient logging, detection, alerting and response that allows breaches to go unnoticed.Foundational
• Security RequirementsStatements of what security properties and controls software must provide, defined early in the SDLC alongside functional requirements.Foundational
• Security Service Edge (SSE)Cloud-delivered security stack combining secure web gateway, CASB and zero trust network access, often with firewall as a service.Intermediate
• Segmentation TestingTesting that verifies network segmentation controls actually isolate sensitive zones from other networks.Intermediate
• SEI CERT Coding StandardsLanguage-specific secure coding rules from Carnegie Mellon's Software Engineering Institute for C, C++, Java, Perl and Android.Intermediate
• Separation of PrivilegeRequire more than one condition, key or party to grant access to sensitive functions.Intermediate
• Shadow APIAn API endpoint that is undocumented or unknown to the security team and therefore unmanaged.Intermediate
• Shadow StackA hardware- or software-protected copy of return addresses used to detect tampering with the regular call stack.Advanced
• Shamir's Secret Sharing (SSS)Algorithm that splits a secret into N shares where any threshold of M shares can reconstruct it.Advanced
• Shor's AlgorithmQuantum algorithm that efficiently factors integers and computes discrete logarithms, breaking RSA, DH, and ECC.Advanced
• Side-Channel AttackAttack that extracts secrets from physical or implementation leaks such as timing, power, or electromagnetic emissions.Advanced
• SigstoreAn open-source project (OpenSSF) providing free tooling and public infrastructure for signing and verifying software artifacts.Advanced
• SLSA Build LevelsThe graded levels of the SLSA Build track that describe increasing guarantees about how an artifact was built.Advanced
• Software and Data Integrity FailuresOWASP Top 10 category for code and infrastructure that do not protect against integrity violations, such as untrusted updates and insecure deserialization.Intermediate
• Software Assurance Maturity Model (SAMM)OWASP's open framework for assessing and improving an organization's software security posture across five business functions.Intermediate
• Software Bill of Materials (SBOM)A formal, machine-readable inventory of all components and dependencies in a piece of software.Intermediate
• Software Package Data Exchange (SPDX)An open standard (ISO/IEC 5962:2021) from the Linux Foundation for communicating SBOM information, including components, licenses and relationships.Intermediate
• Software Security Group (SSG)The central team responsible for an organization's software security initiative.Advanced
• Software Supply Chain FailuresOWASP Top 10 2025 category (A03) for compromises or weaknesses in dependencies, build systems and distribution infrastructure.Intermediate
• Software Supply Chain SecurityProtecting the integrity, provenance and security of all code, dependencies, tools and processes used to build and deliver software.Intermediate
• Software-Defined Perimeter (SDP)Architecture that hides resources from the network and grants per-session access only after authentication.Advanced
• SolarWinds Supply Chain AttackThe 2020 compromise in which attackers inserted the SUNBURST backdoor into SolarWinds Orion builds, which were signed and distributed to about 18,000 customers.Foundational
• Split KnowledgeDividing a secret, such as a cryptographic key, so that no single person knows the whole value.Intermediate
• SQL Injection PreventionThe set of defenses that stop SQL injection, led by parameterized queries and supported by validation and least privilege.Foundational
• SSRF PreventionDefenses that stop an application from being used to send requests to unintended internal or external destinations.Intermediate
• Stack CanaryA random value placed before the return address on the stack and checked before a function returns, detecting stack buffer overflows.Intermediate
• Stack-Based Buffer OverflowWriting past the end of a buffer allocated on the call stack, which can overwrite the saved return address and hijack execution.Intermediate
• Stakeholder-Specific Vulnerability Categorization (SSVC)A decision-tree method for prioritizing vulnerabilities based on exploitation, exposure, automatability and impact.Advanced
• Stateful Hash-Based SignaturesQuantum-resistant signature schemes such as LMS and XMSS that require tracking which one-time keys have been used.Advanced
• Stateless Hash-Based Digital Signature Algorithm (SLH-DSA)NIST post-quantum signature standard (FIPS 205) based on SPHINCS+, relying only on hash function security.Advanced
• Static Code Analysis Taint AnalysisA static analysis technique that tracks untrusted data from sources to dangerous sinks to find injection-type flaws.Advanced
• STRIDEMicrosoft's threat classification mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.Foundational
• STRIDE per ElementA threat modeling technique that applies only the STRIDE categories relevant to each DFD element type.Advanced
• Structured Threat Information Expression (STIX)A standardized JSON language for representing cyber threat intelligence objects and relationships.Intermediate
• Subresource Integrity (SRI)A browser feature that verifies scripts or stylesheets loaded from third parties against a cryptographic hash in the HTML tag.Intermediate
• SUNBURSTThe backdoor inserted into SolarWinds Orion software updates in a 2020 supply chain attack.Advanced
• Supervisory Control and Data Acquisition (SCADA)An ICS architecture for monitoring and controlling geographically dispersed assets from a central location.Foundational
• Supply Chain AttackAn attack that compromises a trusted vendor, software component or service provider to reach its downstream customers.Intermediate
• Symmetric EncryptionEncryption in which the same secret key is used to both encrypt and decrypt data.Foundational
• System for Cross-domain Identity Management (SCIM)REST/JSON standard (RFC 7643/7644) for automating user and group provisioning between identity systems.Intermediate
• Tenant IsolationControls that keep one cloud customer's compute, network and data separate and inaccessible to other tenants.Advanced
• Threat Intelligence LifecycleThe cyclical process for producing intelligence: requirements, collection, processing, analysis, dissemination and feedback.Intermediate
• Threat Model Data Flow Diagram (DFD)A diagram of processes, data stores, external entities, data flows and trust boundaries used as the basis for threat modeling.Intermediate
• Threat ModelingStructured process of identifying threats, attack paths, and mitigations for a system during design.Intermediate
• Threat-Led Penetration Testing (TLPT)An intelligence-driven red team test that emulates the tactics of real threat actors relevant to an organization against live production systems.Advanced
• TIBER-EUThe European Central Bank's framework for Threat Intelligence-Based Ethical Red teaming of financial institutions.Advanced
• Time-of-Check to Time-of-Use (TOCTOU)A race condition in which a resource changes between the time it is checked and the time it is used.Intermediate
• Timing AttackInferring secret information by measuring how long operations take.Advanced
• TLS InspectionDecrypting, inspecting, and re-encrypting TLS traffic at a security device to detect hidden threats and data loss.Intermediate
• TokenizationReplacing sensitive data with a non-sensitive surrogate value (token) that maps back to the original via a secure vault.Intermediate
• Traffic Light Protocol (TLP)A scheme for marking how widely shared threat information may be disseminated.Intermediate
• Transport Layer Security 1.3 (TLS 1.3)Current TLS version (RFC 8446) with a faster handshake, mandatory forward secrecy, and only AEAD ciphers.Intermediate
• TrikeA risk-based threat modeling methodology that starts from a requirements model of actors, assets and allowed actions.Advanced
• TRITONICS malware discovered in 2017 that targeted Schneider Electric Triconex safety instrumented systems at a petrochemical plant.Advanced
• Trust BoundaryA point where data or execution passes between components with different levels of trust.Intermediate
• Trust StoreCollection of trusted root CA certificates maintained by an operating system, browser, or application.Intermediate
• Trusted Automated Exchange of Intelligence Information (TAXII)A protocol for exchanging cyber threat intelligence over HTTPS, designed to carry STIX data.Intermediate
• Trusted Execution Environment (TEE)Hardware-isolated area of a processor that protects code and data from the rest of the system, including the OS.Advanced
• Trusted Platform Module (TPM)Secure cryptoprocessor chip on a device that stores keys, measures boot integrity, and supports attestation.Foundational
• Unidirectional GatewayA hardware-enforced network device that allows data to flow in only one direction, typically from OT out to IT.Intermediate
• Use-After-Free (UAF)Using a pointer to memory after it has been freed, which may now hold attacker-controlled data.Advanced
• Verifiable Credential (VC)Cryptographically signed digital credential, defined by the W3C, that a holder can present and a verifier can check independently.Advanced
• Virtual PatchingBlocking exploitation of a known vulnerability with an external control such as a WAF or IPS rule while the code fix is pending.Intermediate
• Visual, Agile and Simple Threat modeling (VAST)A scalable threat modeling methodology that produces separate application and operational threat models for agile enterprises.Advanced
• Vulnerability Disclosure Policy (VDP)A public policy explaining how external parties can report vulnerabilities and what they can expect in return.Foundational
• Vulnerability Exploitability eXchange (VEX)A machine-readable advisory stating whether a product is actually affected by a known vulnerability in one of its components.Advanced
• Vulnerability Remediation SLAA defined maximum time to fix a vulnerability based on its severity or risk rating.Foundational
• Web Authentication (WebAuthn)W3C API that lets websites register and authenticate users with public key credentials.Advanced
• White TeamThe group that oversees a red team or cyber exercise, setting rules, refereeing, scoring and ensuring safety.Foundational
• WireGuardModern, lightweight VPN protocol using a fixed set of strong cryptographic primitives over UDP.Advanced
• Workload Identity FederationGoogle Cloud feature letting external workloads (AWS, Azure, OIDC/SAML, CI/CD) access Google Cloud without service account keys.Advanced
• WPA3-Enterprise 192-Bit ModeOptional WPA3-Enterprise mode aligned with CNSA, using GCMP-256, HMAC-SHA-384, and EAP-TLS with 384-bit ECC or 3072-bit RSA.Advanced
• X.509ITU-T standard defining the format of public key certificates and certificate revocation lists.Intermediate
• XEX-based Tweaked-codebook mode with ciphertext Stealing (XTS)Block cipher mode designed for disk and storage encryption, using a sector-based tweak.Advanced
• XZ Utils BackdoorA 2024 supply chain compromise (CVE-2024-3094) in which a long-term contributor inserted a backdoor into the xz/liblzma compression library.Intermediate
• Zero Trust Architecture (ZTA)Security model that assumes no implicit trust and continuously verifies every user, device, and request before granting access.Intermediate
• Zero Trust Control PlaneThe zero trust layer where policy decisions are made, separate from the data plane where traffic flows.Advanced
• Zero Trust Network Access (ZTNA)Remote access approach that grants users per-application access based on identity and context, not network access.Intermediate
• Zero-Knowledge Proof (ZKP)Protocol in which one party proves a statement is true without revealing any information beyond its truth.Advanced
• Zombie APIA deprecated or retired API version that is still deployed and reachable.Intermediate
• Zones and ConduitsThe IEC 62443 segmentation concept that groups assets with common security requirements into zones and controls communications between them through conduits.Intermediate