Security Fundamentals & Crypto terms

Study this subject with thinQcards™

• Access ControlSecurity mechanisms that determine who or what can view, use, or change resources, and under what conditions.Foundational
• Access Control List (ACL)Ordered list of rules attached to an object or interface that permits or denies access to specific subjects or traffic.Foundational
• Access Control VestibuleSmall space with two interlocking doors where only one opens at a time, preventing tailgating; formerly called a mantrap.Foundational
• Access ReviewPeriodic verification by managers or owners that users' access rights are still appropriate.Intermediate
• Access TokenCredential issued by an authorization server that a client presents to an API to access protected resources.Intermediate
• Account LockoutDisabling an account temporarily or permanently after a set number of failed login attempts.Foundational
• AccountabilityThe ability to trace actions on a system to a unique, authenticated identity.Foundational
• Active Directory (AD)Microsoft's on-premises directory service for Windows domains, using LDAP, Kerberos, and DNS.Foundational
• Administrative ControlA security control based on policies, procedures, training, and personnel management.Foundational
• Advanced Encryption Standard (AES)NIST-standard symmetric block cipher (Rijndael) with a 128-bit block and 128-, 192-, or 256-bit keys.Foundational
• Air GapPhysically isolating a system or network from all other networks, including the internet.Foundational
• App-IDPalo Alto Networks NGFW technology that identifies applications in traffic regardless of port, protocol, or encryption.Intermediate
• Application-Level Gateway (ALG)Proxy firewall that terminates connections and inspects traffic at the application layer for specific protocols.Intermediate
• Argon2Memory-hard password hashing function that won the 2015 Password Hashing Competition; Argon2id is recommended.Advanced
• Asymmetric EncryptionEncryption using a mathematically related key pair: a public key to encrypt or verify and a private key to decrypt or sign.Foundational
• Attack SurfaceThe total set of points where an unauthorized user could try to enter or extract data from a system.Foundational
• AttestationProcess by which a device or workload provides cryptographic evidence of its identity and integrity to a verifier.Advanced
• Attribute-Based Access Control (ABAC)Access control model that evaluates attributes of the subject, object, action, and environment against policies.Intermediate
• Authenticated Encryption with Associated Data (AEAD)Encryption that provides confidentiality, integrity, and authenticity, while also authenticating unencrypted header data.Advanced
• AuthenticationVerifying that a user, device, or process is who or what it claims to be.Foundational
• Authentication FactorCategory of evidence used to prove identity: something you know, have, or are, plus contextual attributes.Foundational
• Authentication Header (AH)IPsec protocol (IP protocol 51) that provides integrity, data origin authentication, and anti-replay but no encryption.Intermediate
• Authentication, Authorization, and Accounting (AAA)Framework that verifies identity, determines permitted actions, and records what users do.Foundational
• Authenticator AppMobile application that generates TOTP codes or approves push sign-ins as a possession factor.Foundational
• Authenticator Assurance Level (AAL)NIST SP 800-63B rating (AAL1-AAL3) of confidence that the person authenticating controls the account's authenticators.Advanced
• AuthenticityAssurance that data, a message, or an entity is genuine and comes from its claimed source.Foundational
• AuthorizationDetermining what an authenticated subject is permitted to access or do.Foundational
• Authorization Code FlowOAuth grant where the client receives a short-lived code via the browser and exchanges it server-side for tokens.Advanced
• Automated Certificate Management Environment (ACME)Protocol (RFC 8555) that automates domain validation, issuance, and renewal of certificates.Intermediate
• AvailabilitySecurity goal ensuring authorized users have timely, reliable access to data and systems when needed.Foundational
• Avalanche EffectProperty where a tiny change in input, such as one bit, causes a large, unpredictable change in output.Intermediate
• bcryptAdaptive password-hashing function based on Blowfish with a configurable cost factor.Intermediate
• Bell-LaPadula Model (BLP)Formal confidentiality model enforcing 'no read up, no write down' using security labels.Advanced
• Biba ModelFormal integrity model enforcing 'no read down, no write up' to prevent corruption of higher-integrity data.Advanced
• Biometric AuthenticationVerifying identity using unique physiological or behavioral characteristics.Foundational
• Birthday AttackCryptographic attack exploiting the birthday paradox to find hash collisions in about the square root of the output space.Intermediate
• BitLockerMicrosoft Windows full-volume encryption feature that can use a TPM to protect keys.Foundational
• Block CipherA symmetric cipher that encrypts fixed-size blocks of data, such as 128 bits, using a key.Foundational
• BlockchainDistributed, append-only ledger where blocks are cryptographically chained by hashes to resist tampering.Intermediate
• BlowfishSymmetric block cipher by Bruce Schneier with a 64-bit block and variable key length from 32 to 448 bits.Intermediate
• BollardShort, sturdy post that prevents vehicles from entering or ramming into a protected area while allowing pedestrians through.Foundational
• Brewer-Nash ModelAccess control model, also called the Chinese Wall, that prevents conflicts of interest by restricting access dynamically.Advanced
• CA/Browser ForumIndustry body of certificate authorities and browser/OS vendors that sets rules for publicly trusted certificates.Advanced
• Certificate AuthorityTrusted entity that verifies identities and issues, signs, and revokes digital certificates.Foundational
• Certificate Lifecycle Management (CLM)Processes and tools to discover, issue, deploy, renew, and revoke certificates across an organization.Intermediate
• Certificate LifetimeThe validity period of a certificate, between its notBefore and notAfter dates.Intermediate
• Certificate PinningAssociating a host with an expected certificate or public key so other valid-looking certificates are rejected.Advanced
• Certificate Revocation List (CRL)CA-signed list of serial numbers of certificates that have been revoked before their expiration date.Foundational
• Certificate Signing Request (CSR)Message sent to a CA containing a public key and subject information, signed with the requester's private key.Foundational
• Certificate-Based Authentication (CBA)Authenticating a user or device by proving possession of the private key matching a trusted certificate.Intermediate
• Certification Practice Statement (CPS)Document describing how a CA operates and implements its certificate policy.Advanced
• ChaCha20-Poly1305AEAD algorithm combining the ChaCha20 stream cipher with the Poly1305 authenticator, standardized in RFC 8439.Advanced
• Chain of TrustSequence of certificates from an end-entity certificate through intermediates to a trusted root CA.Foundational
• Challenge-Handshake Authentication Protocol (CHAP)PPP authentication protocol using a three-way challenge-response with a hash of a shared secret.Intermediate
• CIA TriadThe three core goals of information security: confidentiality, integrity, and availability.Foundational
• CipherAn algorithm that performs encryption and decryption.Foundational
• Cipher Block Chaining (CBC)Block cipher mode in which each plaintext block is XORed with the previous ciphertext block before encryption.Intermediate
• Cipher SuiteNamed combination of algorithms used by TLS for key exchange, authentication, bulk encryption, and hashing.Intermediate
• CiphertextThe unreadable, encrypted output of a cipher that requires the correct key to decrypt.Foundational
• CISA Zero Trust Maturity Model (ZTMM)CISA framework describing zero trust progress across five pillars and four maturity stages.Advanced
• Cisco Identity Services Engine (Cisco ISE)Cisco's policy and NAC platform providing RADIUS and TACACS+ AAA, profiling, posture, and guest access.Intermediate
• Clark-Wilson ModelCommercial integrity model using well-formed transactions and separation of duties to protect data.Advanced
• Client CertificateCertificate issued to a user or device to authenticate it to a server or network.Intermediate
• Client to Authenticator Protocol (CTAP)FIDO protocol for communication between a client device and an external authenticator over USB, NFC, or Bluetooth.Advanced
• Code Signing CertificateCertificate used to digitally sign software so users can verify its publisher and integrity.Intermediate
• Column-Level EncryptionEncrypting specific database columns so sensitive fields remain protected even from users with table access.Intermediate
• Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)NSA's quantum-resistant algorithm suite and transition timeline for US national security systems.Advanced
• Common Criteria (CC)International standard (ISO/IEC 15408) for evaluating the security of IT products against defined requirements.Advanced
• Complete MediationDesign principle that every access to every object must be checked for authorization every time.Intermediate
• ConfidentialitySecurity goal ensuring information is disclosed only to authorized people, processes, or systems.Foundational
• Confusion and DiffusionShannon's two properties of secure ciphers: hide the key-ciphertext relationship and spread plaintext influence across ciphertext.Advanced
• Context-Aware AuthenticationAuthentication that evaluates contextual signals such as location, device, time, and behavior.Intermediate
• Control DiversityCombining different types of controls, such as technical, administrative, and physical, to protect an asset.Intermediate
• Counter Mode (CTR)Block cipher mode that encrypts a nonce-plus-counter value and XORs the result with plaintext, acting like a stream cipher.Advanced
• Covert ChannelUnauthorized communication path that transfers information in a way that violates security policy.Advanced
• Crime Prevention Through Environmental Design (CPTED)Approach that uses building and landscape design to deter crime through natural surveillance, access control, and territoriality.Advanced
• Cross-CertificationEstablishing trust between separate PKI hierarchies by having CAs sign each other's certificates.Advanced
• Crossover Error Rate (CER)Point where a biometric system's FAR equals its FRR; lower CER means a more accurate system.Intermediate
• CryptanalysisThe study of analyzing and breaking cryptographic systems.Intermediate
• Crypto-ShreddingRendering encrypted data unrecoverable by securely destroying the encryption keys.Intermediate
• Cryptographic AgilityAbility to replace cryptographic algorithms, keys, and parameters quickly without major system redesign.Advanced
• Cryptographic Bill of Materials (CBOM)Inventory of cryptographic assets, algorithms, keys, certificates, and libraries used by a system.Advanced
• Cryptographic KeyA secret or public value used by a cryptographic algorithm to transform data.Foundational
• Cryptographically Relevant Quantum Computer (CRQC)A quantum computer powerful enough to break widely used public key cryptography such as RSA and ECC.Advanced
• Cryptographically Secure Pseudorandom Number Generator (CSPRNG)Random number generator whose output is unpredictable enough for cryptographic use.Advanced
• CryptographyThe science of protecting information by transforming it so only intended parties can read or verify it.Foundational
• Curve25519Elliptic curve designed by Daniel Bernstein for fast, safe Diffie-Hellman key agreement (X25519).Advanced
• DAD TriadThe opposite of the CIA triad: disclosure, alteration, and destruction (denial) of information.Foundational
• Data at RestData stored on persistent media such as disks, databases, backups, or cloud object storage.Foundational
• Data Encryption Standard (DES)Legacy symmetric block cipher with a 64-bit block and 56-bit effective key, now insecure.Foundational
• Data in TransitData moving across a network between systems, also called data in motion.Foundational
• Data in UseData actively being processed in memory or by a CPU, which is typically unencrypted during computation.Intermediate
• Data Loss Prevention (DLP)Technology that detects and blocks unauthorized transmission or storage of sensitive data.Foundational
• Data MaskingObscuring parts of sensitive data so it remains usable for some purposes without revealing the full value.Foundational
• Data StewardRole responsible for data quality, metadata, and appropriate use of data according to policy.Intermediate
• Defense in DepthLayering multiple, independent security controls so that the failure of one does not compromise the asset.Foundational
• DeprovisioningRemoving or disabling a user's accounts and access when they leave or no longer need it.Foundational
• Device Posture CheckEvaluating a device's security state, such as patch level, encryption, and EDR status, before granting access.Intermediate
• DiameterAAA protocol designed as a successor to RADIUS, using TCP or SCTP on port 3868.Intermediate
• Diffie-Hellman (DH)Key agreement protocol that lets two parties derive a shared secret over an insecure channel.Foundational
• Digital CertificateElectronic document signed by a CA that binds a public key to an identity such as a domain, person, or device.Foundational
• Digital SignatureCryptographic value created with a private key over a message hash that proves origin, integrity, and non-repudiation.Foundational
• Digital Signature Algorithm (DSA)Legacy NIST signature algorithm based on the discrete logarithm problem.Intermediate
• Directory ServiceCentralized database that stores and organizes information about users, groups, devices, and resources for authentication and lookup.Foundational
• Discretionary Access Control (DAC)Access control model where the owner of a resource decides who may access it.Foundational
• Distinguished Encoding Rules (DER)Binary encoding format for X.509 certificates and keys.Intermediate
• Domain Validation Certificate (DV)Certificate issued after the CA verifies only that the requester controls the domain.Foundational
• Dual ControlRequiring two or more authorized people to act together to perform a sensitive operation.Intermediate
• Dynamic SecretsCredentials generated on demand for each client with a short lease, then automatically revoked.Advanced
• Economy of MechanismSaltzer and Schroeder principle that security designs should be as simple and small as possible.Intermediate
• Edwards-curve Digital Signature Algorithm (EdDSA)Deterministic signature scheme on twisted Edwards curves, most commonly Ed25519.Advanced
• Electromagnetic LockLock that uses an electromagnet to hold a door closed, releasing when power is removed.Intermediate
• Electronic Codebook (ECB)Block cipher mode that encrypts each block independently, so identical plaintext blocks yield identical ciphertext.Intermediate
• ElGamalAsymmetric encryption and signature scheme based on the discrete logarithm problem, an extension of Diffie-Hellman.Advanced
• Elliptic Curve Cryptography (ECC)Public key cryptography based on elliptic curve math, offering strong security with short keys.Intermediate
• Elliptic Curve Diffie-Hellman (ECDH)Diffie-Hellman key agreement performed with elliptic curve groups, providing equal security with smaller keys.Intermediate
• Elliptic Curve Digital Signature Algorithm (ECDSA)Digital signature algorithm using elliptic curve cryptography, standardized in FIPS 186-5.Intermediate
• Encapsulating Security Payload (ESP)IPsec protocol (IP protocol 50) that provides confidentiality, integrity, authentication, and anti-replay.Intermediate
• Encrypting File System (EFS)Windows NTFS feature that encrypts individual files and folders using certificate-protected keys.Intermediate
• EncryptionConverting plaintext into ciphertext using an algorithm and key so only authorized parties can read it.Foundational
• Enterprise Access ModelMicrosoft model separating access into control, management, data/workload, and user/app access planes, replacing the legacy tier model.Advanced
• Enterprise Security ArchitectureStructured design of security controls, processes, and technologies aligned to an organization's business goals and risks.Intermediate
• EntropyMeasure of randomness or unpredictability, critical for generating strong keys and passwords.Intermediate
• Ephemeral KeyA key generated for a single session or transaction and discarded afterward.Intermediate
• Extended Validation Certificate (EV)Certificate issued after the most rigorous CA vetting of an organization's legal, physical, and operational existence.Intermediate
• Extensible Authentication Protocol (EAP)Authentication framework supporting multiple methods, used with 802.1X, PPP, and wireless networks.Intermediate
• Extensible Authentication Protocol-Transport Layer Security (EAP-TLS)EAP method using mutual certificate authentication between client and server.Intermediate
• Fail-OpenFailure mode where a system allows access or traffic to continue when it fails, favoring availability.Intermediate
• Fail-SafeFailure mode that defaults to a state protecting human life, often unlocking doors when power fails.Foundational
• Fail-SecureFailure mode where a system defaults to a locked or denied state, protecting assets when it fails.Foundational
• False Acceptance Rate (FAR)Biometric error rate at which unauthorized users are incorrectly accepted; a Type II error.Intermediate
• False Rejection Rate (FRR)Biometric error rate at which legitimate users are incorrectly rejected; a Type I error.Intermediate
• Faraday CageEnclosure of conductive material that blocks electromagnetic fields and radio signals.Intermediate
• Federal Information Processing Standard 140-3 (FIPS 140-3)US/Canadian standard for validating cryptographic modules at four increasing security levels.Advanced
• FederationTrust relationship letting identities from one domain access resources in another without separate accounts.Intermediate
• Feistel NetworkBlock cipher structure that splits data into halves and applies repeated rounds of a round function and swapping.Advanced
• FIDO2FIDO Alliance and W3C standard for phishing-resistant, public key-based passwordless authentication.Intermediate
• File-Level EncryptionEncrypting individual files rather than entire volumes, so protection can travel with the file.Foundational
• FileVaultApple macOS full disk encryption feature using XTS-AES-128 with a 256-bit key.Foundational
• Fire Suppression SystemSystem that detects and extinguishes fires, chosen to match fire classes and protect people and equipment.Intermediate
• FN-DSAFFT over NTRU-Lattice-Based Digital Signature Algorithm, NIST's Falcon-based post-quantum signature standard (FIPS 206).Advanced
• Full Disk Encryption (FDE)Encrypting an entire storage device, including the OS and free space, so data is unreadable without authentication.Foundational
• Galois/Counter Mode (GCM)Authenticated block cipher mode combining counter mode encryption with Galois field authentication (GHASH).Intermediate
• GeofencingUsing a device's geographic location to create virtual boundaries that trigger security policies.Foundational
• GNU Privacy Guard (GPG)Free, open-source implementation of the OpenPGP standard.Foundational
• Google Cloud Key Management Service (Cloud KMS)Google Cloud service for managing cryptographic keys, with software, HSM, and external key options.Intermediate
• Group PolicyWindows Active Directory feature for centrally applying security and configuration settings to users and computers.Intermediate
• Grover's AlgorithmQuantum search algorithm offering a quadratic speedup that effectively halves symmetric key and hash security.Advanced
• Hamming Quasi-Cyclic (HQC)Code-based key encapsulation mechanism selected by NIST in March 2025 as a backup to ML-KEM.Advanced
• HardeningReducing a system's attack surface by removing unnecessary functions and applying secure configurations.Foundational
• Hardware Security KeyPhysical token, such as a USB or NFC key, that performs FIDO2 or U2F authentication.Foundational
• Hardware Security Module (HSM)Tamper-resistant hardware device that generates, stores, and uses cryptographic keys without exposing them.Foundational
• Harvest Now, Decrypt Later (HNDL)Strategy of collecting encrypted data today to decrypt it once a quantum computer can break the encryption.Advanced
• Hash CollisionWhen two different inputs produce the same hash digest.Intermediate
• Hash FunctionOne-way function that maps input of any size to a fixed-size digest, used to verify integrity.Foundational
• Hash-Based Message Authentication Code (HMAC)MAC construction that combines a cryptographic hash function with a secret key (RFC 2104).Intermediate
• HMAC-Based One-Time Password (HOTP)OTP algorithm (RFC 4226) that generates codes from a shared secret and an incrementing counter.Intermediate
• Hold Your Own Key (HYOK)Model where encryption keys remain in customer-controlled systems outside the cloud provider at all times.Advanced
• Homomorphic EncryptionEncryption that allows computation on ciphertext, producing encrypted results that decrypt to the correct answer.Advanced
• Host-Based FirewallSoftware firewall running on an individual endpoint that filters traffic to and from that host.Foundational
• HTTP Strict Transport Security (HSTS)HTTP response header instructing browsers to connect to a site only over HTTPS for a set time.Intermediate
• Hybrid CryptosystemSystem that uses asymmetric cryptography to exchange a symmetric key, then symmetric encryption for bulk data.Foundational
• Hybrid Key ExchangeCombining a classical and a post-quantum key exchange so the session is secure if either algorithm holds.Advanced
• ID TokenOIDC JSON Web Token that asserts the identity of the authenticated user to the client application.Advanced
• IdentificationThe act of a subject claiming an identity, such as entering a username, before it is authenticated.Foundational
• Identity and Access Management (IAM)Policies, processes, and technologies for managing digital identities and controlling their access to resources.Foundational
• Identity Governance and Administration (IGA)Discipline and tools for managing identity lifecycle, access requests, certifications, and policy compliance.Advanced
• Identity Lifecycle ManagementManaging identities from creation through role changes to removal, often called joiner-mover-leaver.Intermediate
• Identity ProofingVerifying that a person is who they claim to be before issuing credentials.Intermediate
• Identity Provider (IdP)System that authenticates users and issues identity assertions or tokens to relying applications.Foundational
• IEEE 802.1XPort-based network access control standard that authenticates devices before allowing traffic on wired or wireless networks.Foundational
• Implicit DenyDefault rule that blocks any traffic or access not explicitly permitted.Foundational
• Implicit Trust ZoneArea behind a policy enforcement point where entities are trusted to the last enforcement check.Advanced
• Impossible TravelDetection that flags sign-ins from geographically distant locations within a time too short for real travel.Intermediate
• Information Rights Management (IRM)Technology that applies persistent usage restrictions to documents and emails wherever they travel.Intermediate
• Inherence FactorAuthentication factor based on something the user is, such as a fingerprint, face, iris, or voice.Foundational
• Initialization Vector (IV)A random or unique value combined with a key to ensure the same plaintext encrypts to different ciphertext.Intermediate
• IntegritySecurity goal ensuring data and systems are accurate, complete, and not altered by unauthorized parties.Foundational
• Intermediate Certificate AuthorityA subordinate CA whose certificate is signed by a root or another intermediate and that issues end-entity certificates.Foundational
• Internet Key Exchange (IKE)Protocol that negotiates IPsec security associations and keys, using UDP 500 and UDP 4500 for NAT traversal.Advanced
• Internet of Things SecurityPractices for protecting connected devices with limited resources, long lifespans, and often weak default security.Intermediate
• Internet Protocol Security (IPsec)Suite of protocols that authenticates and encrypts IP packets, used mainly for site-to-site and remote-access VPNs.Intermediate
• Intrusion Detection System (IDS)System that monitors network or host activity and alerts on suspicious or malicious behavior without blocking it.Foundational
• Intrusion Prevention System (IPS)Inline security system that detects and actively blocks malicious traffic in real time.Foundational
• IsolationSeparating processes, systems, or networks so that compromise of one does not affect others.Foundational
• Job RotationPeriodically moving staff between roles to reduce fraud risk, detect misuse, and cross-train employees.Foundational
• Jump ServerHardened intermediary host used to access and manage devices in a secure zone.Intermediate
• Just-in-Time Access (JIT Access)Granting elevated privileges only when needed and only for a limited time, removing standing privileges.Intermediate
• Just-in-Time Provisioning (JIT Provisioning)Creating a user account in an application automatically on first sign-in using attributes from the IdP's assertion.Intermediate
• KerberosTicket-based network authentication protocol using a trusted KDC and symmetric cryptography.Intermediate
• Kerckhoffs's PrincipleA cryptosystem should remain secure even if everything about it except the key is public knowledge.Intermediate
• Key CeremonyFormal, audited procedure for generating or using high-value keys, such as a root CA key, under multi-person control.Advanced
• Key Derivation Function (KDF)Function that derives one or more cryptographic keys from a secret value such as a password or shared secret.Advanced
• Key Distribution Center (KDC)Kerberos component that authenticates principals and issues tickets, consisting of the AS and TGS.Advanced
• Key Encapsulation Mechanism (KEM)Public key scheme that encapsulates a randomly generated shared secret for a recipient's public key.Advanced
• Key Encryption Key (KEK)A key used to encrypt (wrap) other keys rather than data.Intermediate
• Key EscrowStoring a copy of cryptographic keys with a trusted third party so they can be recovered if needed.Intermediate
• Key ExchangeProcess by which parties establish a shared cryptographic key, by key transport or key agreement.Foundational
• Key LengthThe size of a cryptographic key in bits, which determines the size of the key space and resistance to brute force.Foundational
• Key LifecycleStages a cryptographic key passes through: generation, distribution, storage, use, rotation, archival, and destruction.Intermediate
• Key ManagementPractices and systems for securely generating, distributing, storing, rotating, and destroying cryptographic keys.Foundational
• Key Management Service (KMS)Managed cloud service for creating, storing, controlling, and auditing cryptographic keys.Intermediate
• Key Recovery AgentDesignated person or account authorized to recover encrypted data or archived private keys.Intermediate
• Key RotationReplacing cryptographic keys with new ones on a schedule or after suspected compromise.Intermediate
• Key SpaceThe total number of possible keys for an algorithm, equal to 2 to the power of the key length for random binary keys.Intermediate
• Key StretchingTechnique that makes a weak key or password more resistant to brute force by applying many computational rounds.Foundational
• Key Usage ExtensionX.509 extensions that restrict what a certificate's key may be used for, such as signing or server authentication.Advanced
• Knowledge FactorAuthentication factor based on something the user knows, such as a password, PIN, or passphrase.Foundational
• Lattice-Based CryptographyCryptography based on hard problems over mathematical lattices, such as learning with errors, believed quantum-resistant.Advanced
• Layered SecuritySynonym for defense in depth: multiple overlapping security measures protecting the same asset.Foundational
• Least Common MechanismDesign principle that mechanisms shared by multiple users should be minimized to reduce unintended information paths.Advanced
• Least PrivilegePrinciple of granting users and processes only the minimum access rights needed to perform their tasks.Foundational
• Lightweight CryptographyCryptographic algorithms designed for constrained devices with limited power, memory, and processing.Advanced
• Lightweight Directory Access Protocol over SSL (LDAPS)LDAP secured with TLS on TCP port 636 to protect directory queries and credentials.Foundational
• Linux Unified Key Setup (LUKS)Standard Linux disk encryption format built on dm-crypt that supports multiple passphrase key slots.Intermediate
• Login BannerWarning message displayed before or at sign-in stating that use is monitored and unauthorized access is prohibited.Foundational
• M of N ControlRequiring any M of N designated custodians to cooperate to perform a sensitive operation.Intermediate
• Mandatory Access Control (MAC)Access control model where a central authority enforces access based on security labels and clearances.Foundational
• Mandatory VacationPolicy requiring employees to take consecutive days off so others can perform their duties and uncover fraud.Foundational
• Measured BootBoot process that records hashes of each component into the TPM so the boot state can be verified later.Advanced
• Media Access Control Security (MACsec)IEEE 802.1AE standard providing Layer 2 hop-by-hop encryption and integrity on Ethernet links.Advanced
• Message Authentication Code (MAC)Short tag computed with a shared secret key that verifies a message's integrity and origin.Intermediate
• Message Digest 5 (MD5)Legacy 128-bit hash function that is broken for collision resistance.Foundational
• MicrosegmentationDividing networks into very small, workload-level zones with granular policies controlling east-west traffic.Intermediate
• Mode of OperationA method that defines how a block cipher repeatedly applies its transformation to encrypt data longer than one block.Intermediate
• Module-Lattice-Based Digital Signature Algorithm (ML-DSA)NIST post-quantum digital signature standard (FIPS 204), derived from CRYSTALS-Dilithium.Advanced
• Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)NIST post-quantum key encapsulation standard (FIPS 203), derived from CRYSTALS-Kyber.Advanced
• Mosca's TheoremRule stating that if data's secrecy lifetime plus migration time exceeds the time to a quantum threat, action is overdue.Advanced
• Multifactor Authentication (MFA)Authentication requiring two or more factors from different categories.Foundational
• Need to KnowPrinciple that access to specific information is granted only when it is required for a person's duties.Foundational
• Network Access Control (NAC)Technology that authenticates and checks devices before granting network access, enforcing policy at the edge.Foundational
• Network SegmentationDividing a network into separate zones, such as VLANs or subnets, with controlled traffic between them.Foundational
• Next-Generation Firewall (NGFW)Firewall that adds application awareness, user identity, intrusion prevention, and threat intelligence to stateful inspection.Intermediate
• NIST IR 8547NIST report setting the timeline to deprecate and then disallow quantum-vulnerable public key algorithms.Advanced
• Non-repudiationAssurance that a party cannot credibly deny having performed an action, such as sending a message or signing a document.Foundational
• NonceA 'number used once' that ensures uniqueness in a cryptographic operation to prevent replay and keystream reuse.Intermediate
• NT LAN Manager (NTLM)Legacy Microsoft challenge-response authentication protocol, now deprecated in favor of Kerberos.Intermediate
• Number MatchingPush MFA enhancement requiring the user to enter a number shown on the sign-in screen into the authenticator app.Intermediate
• ObfuscationMaking data or code difficult to understand without changing its function, to hinder analysis.Foundational
• OCSP StaplingTLS feature where the server fetches and attaches a signed OCSP response to its handshake.Intermediate
• Offline Root CAA root certificate authority kept powered off or disconnected from networks to protect its private key.Intermediate
• One-Time Pad (OTP)Cipher using a truly random key as long as the message, used only once, offering information-theoretic security.Intermediate
• One-Time Password (OTP)Password valid for only one login session or transaction, generated by a token, app, or service.Foundational
• Online Certificate Status Protocol (OCSP)Protocol (RFC 6960) for querying the real-time revocation status of a single certificate.Intermediate
• Open DesignDesign principle that security should not depend on the secrecy of the design or implementation.Intermediate
• OpenID Connect (OIDC)Identity layer on top of OAuth 2.0 that authenticates users and returns an ID token.Intermediate
• Organization Validation Certificate (OV)Certificate issued after the CA verifies domain control and the legal existence of the requesting organization.Intermediate
• Out-of-Band Key ExchangeDelivering keys through a separate channel from the one the keys will protect.Intermediate
• Packet-Filtering FirewallStateless firewall that allows or denies individual packets based on header information such as IP, port, and protocol.Foundational
• Parkerian HexadDonn Parker's six-element security model: confidentiality, possession, integrity, authenticity, availability, and utility.Intermediate
• PasskeyFIDO2 discoverable credential that replaces passwords, either synced across devices or bound to one device.Intermediate
• Password Authentication Protocol (PAP)Legacy PPP authentication protocol that sends usernames and passwords in cleartext.Foundational
• Password HashingStoring passwords as salted, slow, one-way hashes rather than plaintext or reversible encryption.Intermediate
• Password ManagerApplication that generates, stores, and autofills strong unique passwords in an encrypted vault.Foundational
• Password PolicyRules governing password creation, storage, and use, now guided by NIST SP 800-63B.Foundational
• Password-Based Key Derivation Function 2 (PBKDF2)Key derivation function that applies an HMAC many times with a salt to stretch a password.Intermediate
• Passwordless AuthenticationAuthentication methods that remove passwords, using cryptographic keys, biometrics, or possession factors instead.Intermediate
• PepperA secret value added to passwords before hashing and stored separately from the password database.Intermediate
• Perfect Forward Secrecy (PFS)Property ensuring that compromise of long-term keys does not compromise past session keys.Intermediate
• Personal Identity Verification (PIV)US federal smart card standard (FIPS 201) for employee and contractor identity credentials.Intermediate
• Phishing-Resistant MFAMFA methods that cannot be relayed or tricked into authenticating to a fake site, such as FIDO2 or PKI.Intermediate
• Physical SecurityProtecting facilities, hardware, and people from physical threats such as unauthorized entry, theft, and environmental hazards.Foundational
• PlaintextReadable, unencrypted data that is input to an encryption algorithm or output from decryption.Foundational
• Policy Decision Point (PDP)Zero trust component that evaluates access requests against policy and decides whether to grant them.Advanced
• Policy Enforcement Point (PEP)Zero trust component that enables, monitors, and terminates connections between subjects and resources as directed by the PDP.Advanced
• Port SecuritySwitch feature that limits which or how many MAC addresses can use a port.Foundational
• Possession FactorAuthentication factor based on something the user has, such as a security key, smartphone, or smart card.Foundational
• Post-Quantum Cryptography (PQC)Classical cryptographic algorithms designed to resist attacks by both classical and quantum computers.Intermediate
• Pre-Shared Key (PSK)Secret shared in advance between parties and used for authentication or key derivation.Foundational
• Pretty Good Privacy (PGP)Encryption program and standard (OpenPGP) for signing and encrypting email and files using a hybrid cryptosystem.Foundational
• Principle of Least FunctionalityConfiguring systems to provide only essential capabilities and disabling unneeded ports, protocols, and services.Intermediate
• Privacy-Enhanced Mail Format (PEM)Base64-encoded certificate or key format wrapped in -----BEGIN----- and -----END----- lines.Foundational
• Private KeyThe secret half of an asymmetric key pair, used to decrypt data or create digital signatures.Foundational
• Privilege CreepGradual accumulation of access rights beyond what a user's current role requires.Foundational
• Privileged Access Management (PAM)Controls and tools that secure, monitor, and limit use of administrative and other privileged accounts.Intermediate
• Privileged Access Workstation (PAW)Hardened, dedicated device used only for administrative tasks to protect privileged credentials.Advanced
• Privileged Identity Management (PIM)Microsoft Entra ID feature providing just-in-time, time-bound, and approval-based activation of privileged roles.Intermediate
• Proof Key for Code Exchange (PKCE)OAuth extension (RFC 7636) that binds an authorization code to the client that requested it.Advanced
• Protected Extensible Authentication Protocol (PEAP)EAP method that creates a TLS tunnel using only a server certificate, then authenticates the user inside it.Intermediate
• Protected Management Frames (PMF)IEEE 802.11w feature that authenticates and protects Wi-Fi management frames such as deauthentication.Advanced
• Proximity CardContactless access card read by radio frequency when held near a reader, commonly used for badge entry.Foundational
• Psychological AcceptabilityDesign principle that security mechanisms should be easy to use so people do not bypass them.Intermediate
• Public KeyThe shareable half of an asymmetric key pair, used to encrypt data for the owner or verify the owner's signatures.Foundational
• Public Key Cryptography Standards (PKCS)Set of standards originally published by RSA Laboratories for public key cryptography formats and operations.Advanced
• Public Key Cryptography Standards #12 (PKCS #12)Password-protected archive format (.pfx/.p12) that bundles a certificate, its chain, and the private key.Intermediate
• Public Key Cryptography Standards #7 (PKCS #7)Format (.p7b/.p7c) for signed or enveloped data, often used to bundle certificate chains without private keys.Intermediate
• Public Key Infrastructure (PKI)Framework of CAs, policies, and technology for issuing, managing, and revoking digital certificates.Foundational
• Push Notification AuthenticationMFA method where a sign-in prompt is sent to a registered mobile app for the user to approve.Foundational
• Quantum Key Distribution (QKD)Method that uses quantum properties of photons to distribute keys with eavesdropping detection.Advanced
• Recovery ControlA control that restores systems, data, and operations after a disruptive incident.Intermediate
• RedundancyDuplicating critical components so a backup takes over if one fails.Foundational
• Reference MonitorAbstract machine that mediates all access by subjects to objects according to a security policy.Advanced
• Refresh TokenLong-lived OAuth credential used to obtain new access tokens without re-prompting the user.Advanced
• Registration AuthorityPKI component that verifies the identity of certificate requesters before the CA issues certificates.Intermediate
• Remote Authentication Dial-In User Service (RADIUS)AAA protocol commonly used for network access, using UDP 1812 (authentication) and 1813 (accounting).Foundational
• Risk-Based AuthenticationAdjusting authentication requirements dynamically based on the calculated risk of each sign-in.Intermediate
• Rivest Cipher 4 (RC4)Legacy stream cipher once used in WEP, WPA-TKIP, and SSL/TLS, now prohibited due to biases.Intermediate
• Rivest-Shamir-Adleman (RSA)Asymmetric algorithm based on the difficulty of factoring large integers, used for encryption and digital signatures.Foundational
• Root Certificate Authority (Root CA)The top-level CA in a hierarchy whose self-signed certificate is the trust anchor for all subordinate certificates.Foundational
• Root of Trust (RoT)Inherently trusted hardware or firmware component from which a chain of trust is built.Intermediate
• Rule-Based Access Control (RuBAC)Access control model that applies global rules to all subjects, such as time-of-day or firewall rules.Foundational
• SAML AssertionSigned XML statement from an IdP containing authentication, attribute, and authorization information about a subject.Advanced
• SandboxingRunning code in a restricted, isolated environment that limits its access to the system.Foundational
• Screened SubnetNetwork segment, formerly called a DMZ, that hosts public-facing services between the internet and the internal network.Foundational
• scryptMemory-hard key derivation function designed to make large-scale hardware password cracking expensive.Advanced
• Secure BootUEFI feature that allows only cryptographically signed bootloaders and OS components to run at startup.Intermediate
• Secure by DefaultPrinciple that systems ship with the most secure settings enabled out of the box.Foundational
• Secure by DesignApproach where security is built into a product's architecture and development from the start rather than added later.Intermediate
• Secure EnclaveIsolated, hardware-protected processor or memory region that handles sensitive data and keys apart from the main OS.Intermediate
• Secure Hash Algorithm 1 (SHA-1)Legacy 160-bit hash function with practical collision attacks; deprecated for security use.Foundational
• Secure Hash Algorithm 2 (SHA-2)NIST family of hash functions including SHA-224, SHA-256, SHA-384, and SHA-512.Foundational
• Secure Hash Algorithm 3 (SHA-3)NIST hash standard based on the Keccak sponge construction, standardized in FIPS 202.Intermediate
• Secure Multi-Party Computation (SMPC)Cryptographic technique letting parties jointly compute a function over their inputs without revealing those inputs to each other.Advanced
• Secure Real-time Transport Protocol (SRTP)Profile of RTP that provides encryption, authentication, and replay protection for voice and video streams.Intermediate
• Secure Web Gateway (SWG)Security service that filters user web traffic for malware, URL categories, and policy violations.Intermediate
• Secure/Multipurpose Internet Mail Extensions (S/MIME)Standard for signing and encrypting email using X.509 certificates.Intermediate
• Security Assertion Markup Language (SAML)XML-based standard for exchanging authentication and authorization data between an IdP and SP.Intermediate
• Security BaselineA documented minimum set of security configurations and controls that a system type must meet.Foundational
• Security KernelThe hardware, firmware, and software within the TCB that implements the reference monitor concept.Advanced
• Security PerimeterThe boundary separating trusted components from untrusted ones, either within a system or around a network.Foundational
• Security PostureAn organization's overall security status and its ability to prevent, detect, and respond to threats.Foundational
• Security Through ObscurityRelying on secrecy of design or implementation, rather than sound controls, as the main form of protection.Foundational
• Security ZoneLogical grouping of networks or interfaces with the same trust level, with policy applied between zones.Foundational
• Self-Encrypting Drive (SED)Storage drive with built-in hardware encryption that encrypts all data automatically.Intermediate
• Self-Signed CertificateCertificate signed with its own private key rather than by a trusted CA.Foundational
• Sensitivity LabelMicrosoft Purview metadata tag that classifies content and can apply encryption, marking, and DLP policies.Intermediate
• Separation of Duties (SoD)Dividing a critical task among multiple people so no single individual can complete it alone.Foundational
• Service Provider (SP)Application that relies on an identity provider's assertion to grant users access; called a relying party in OIDC.Intermediate
• Session KeyA temporary symmetric key used to encrypt a single communication session.Foundational
• Shamir's Secret Sharing (SSS)Algorithm that splits a secret into N shares where any threshold of M shares can reconstruct it.Advanced
• Sherwood Applied Business Security Architecture (SABSA)Business-driven enterprise security architecture framework built on six layers of views.Advanced
• Shor's AlgorithmQuantum algorithm that efficiently factors integers and computes discrete logarithms, breaking RSA, DH, and ECC.Advanced
• Side-Channel AttackAttack that extracts secrets from physical or implementation leaks such as timing, power, or electromagnetic emissions.Advanced
• Simple Network Management Protocol version 3 (SNMPv3)Version of SNMP adding user-based authentication and encryption for device monitoring and management.Foundational
• Simultaneous Authentication of Equals (SAE)Password-authenticated key exchange (Dragonfly) used by WPA3-Personal.Intermediate
• Single Sign-On (SSO)Allowing a user to authenticate once and access multiple applications without signing in again.Foundational
• Smart CardCredit-card-sized card with an embedded chip that securely stores certificates and private keys for authentication.Foundational
• SMS-Based AuthenticationSending one-time codes by text message as a second factor; convenient but weak.Foundational
• Software-Defined Perimeter (SDP)Architecture that hides resources from the network and grants per-session access only after authentication.Advanced
• Split KnowledgeDividing a secret, such as a cryptographic key, so that no single person knows the whole value.Intermediate
• Split TunnelingVPN configuration that sends only corporate traffic through the tunnel while other traffic goes directly to the internet.Foundational
• Stateful Hash-Based SignaturesQuantum-resistant signature schemes such as LMS and XMSS that require tracking which one-time keys have been used.Advanced
• Stateless Hash-Based Digital Signature Algorithm (SLH-DSA)NIST post-quantum signature standard (FIPS 205) based on SPHINCS+, relying only on hash function security.Advanced
• SteganographyHiding the existence of data inside other data, such as an image, audio, or network traffic.Foundational
• Stream CipherA symmetric cipher that encrypts data one bit or byte at a time by combining it with a pseudorandom keystream.Foundational
• Subject Alternative Name (SAN)X.509 extension listing additional identities, such as DNS names or IPs, that a certificate is valid for.Foundational
• Substitution CipherCipher that replaces each plaintext unit with another symbol according to a fixed or keyed system.Foundational
• Symmetric EncryptionEncryption in which the same secret key is used to both encrypt and decrypt data.Foundational
• System for Cross-domain Identity Management (SCIM)REST/JSON standard (RFC 7643/7644) for automating user and group provisioning between identity systems.Intermediate
• TEMPESTStandards and techniques for limiting compromising electromagnetic emanations from electronic equipment.Advanced
• Temporal Key Integrity Protocol (TKIP)Interim WPA encryption protocol that wrapped RC4 with per-packet keys and a MIC; now deprecated.Intermediate
• Terminal Access Controller Access-Control System Plus (TACACS+)Cisco-developed AAA protocol over TCP 49 that encrypts the full payload and separates authentication, authorization, and accounting.Foundational
• Threat ModelingStructured process of identifying threats, attack paths, and mitigations for a system during design.Intermediate
• Ticket-Granting Ticket (TGT)Kerberos ticket issued after initial authentication that is used to request service tickets.Advanced
• Time-Based One-Time Password (TOTP)OTP algorithm (RFC 6238) that generates codes from a shared secret and the current time, typically every 30 seconds.Foundational
• Time-of-Day RestrictionsAccess controls that limit when accounts can log in or resources can be used.Foundational
• TLS InspectionDecrypting, inspecting, and re-encrypting TLS traffic at a security device to detect hidden threats and data loss.Intermediate
• TokenizationReplacing sensitive data with a non-sensitive surrogate value (token) that maps back to the original via a secure vault.Intermediate
• Transparent Data Encryption (TDE)Database feature that encrypts data and log files at rest without requiring application changes.Intermediate
• Transport Layer Security 1.3 (TLS 1.3)Current TLS version (RFC 8446) with a faster handshake, mandatory forward secrecy, and only AEAD ciphers.Intermediate
• Transposition CipherCipher that rearranges the order of plaintext characters without changing the characters themselves.Foundational
• Triple DES (3DES)Symmetric cipher applying DES three times (encrypt-decrypt-encrypt) to increase effective key strength.Foundational
• Trust BoundaryA point where data or execution passes between components with different levels of trust.Intermediate
• Trust StoreCollection of trusted root CA certificates maintained by an operating system, browser, or application.Intermediate
• Trusted Computing Base (TCB)All hardware, firmware, and software components critical to enforcing a system's security policy.Advanced
• Trusted Execution Environment (TEE)Hardware-isolated area of a processor that protects code and data from the rest of the system, including the OS.Advanced
• Trusted Platform Module (TPM)Secure cryptoprocessor chip on a device that stores keys, measures boot integrity, and supports attestation.Foundational
• TwofishSymmetric block cipher with a 128-bit block and keys up to 256 bits; an AES competition finalist.Intermediate
• Unified Threat Management (UTM)All-in-one security appliance combining firewall, IPS, antivirus, web filtering, VPN, and other functions.Foundational
• User-IDPalo Alto Networks feature that maps IP addresses to usernames so firewall policies can be based on users and groups.Intermediate
• Vendor DiversityUsing products from different vendors in layered defenses so a single flaw cannot defeat all layers.Intermediate
• Verifiable Credential (VC)Cryptographically signed digital credential, defined by the W3C, that a holder can present and a verifier can check independently.Advanced
• Video SurveillanceUse of cameras (CCTV or IP cameras) to deter, detect, and record physical security events.Foundational
• Virtual Private Network (VPN)Encrypted tunnel that securely connects remote users or sites across an untrusted network.Foundational
• Web Application Firewall (WAF)Layer 7 firewall that inspects HTTP/HTTPS traffic to protect web applications from attacks such as SQL injection and XSS.Foundational
• Web Authentication (WebAuthn)W3C API that lets websites register and authenticate users with public key credentials.Advanced
• Web of TrustDecentralized trust model where users vouch for one another's public keys instead of relying on a central CA.Intermediate
• Wi-Fi Protected Access 3 (WPA3)Current Wi-Fi security standard that uses SAE for personal networks and mandates protected management frames.Foundational
• Wildcard CertificateCertificate that secures all first-level subdomains of a domain using an asterisk, such as *.example.com.Foundational
• Windows Hello for Business (WHfB)Microsoft passwordless authentication using a TPM-protected key pair unlocked by a PIN or biometric.Intermediate
• Wired Equivalent Privacy (WEP)Original, broken 802.11 encryption protocol using RC4 with a 24-bit IV.Foundational
• WireGuardModern, lightweight VPN protocol using a fixed set of strong cryptographic primitives over UDP.Advanced
• Work FactorThe estimated time or effort required to break a cryptosystem or security control.Intermediate
• X.509ITU-T standard defining the format of public key certificates and certificate revocation lists.Intermediate
• XEX-based Tweaked-codebook mode with ciphertext Stealing (XTS)Block cipher mode designed for disk and storage encryption, using a sector-based tweak.Advanced
• Zero Trust Architecture (ZTA)Security model that assumes no implicit trust and continuously verifies every user, device, and request before granting access.Intermediate
• Zero Trust Control PlaneThe zero trust layer where policy decisions are made, separate from the data plane where traffic flows.Advanced
• Zero Trust Network Access (ZTNA)Remote access approach that grants users per-application access based on identity and context, not network access.Intermediate
• Zero-Knowledge Proof (ZKP)Protocol in which one party proves a statement is true without revealing any information beyond its truth.Advanced