Cybersecurity Glossary

Attack and threat

APT: Advanced Persistent Threat. A well-resourced, persistent adversary aiming not at a one-off intrusion but at long-term, undetected presence. Typically state-backed or organised crime.
Lateral movement: The attacker's sideways spread within the network, from the first compromised machine to the real target. A flat, unsegmented network makes this cheap; segmentation is the defence.
Zero-day: A vulnerability with no vendor fix available. Defence here is not patching but compensating controls: segmentation, allow-listing, behavioural detection.
Ransomware: Malware that encrypts data and demands payment. Current variants exfiltrate data before encrypting, so having backups does not save the victim from paying.
Phishing: A deceptive message aimed at obtaining credentials or money. The most common initial intrusion vector. Modern variants are no longer given away by linguistic errors.
Social engineering: Exploiting human trust instead of technical weaknesses. Includes phishing, pretexting by phone and physical intrusion.
C2 (Command and Control): The attacker's control channel to a compromised machine. Outbound traffic analysis often catches the attack here, when everything else on the host is quiet.
Supply chain attack: Compromising a supplier or a software component rather than the target directly, and entering through it.
Privilege escalation: Moving from a low-privilege account to administrator. Obtaining domain administrator is the turning point of most attacks.
MFA fatigue: An attack pattern where the adversary has the password and repeatedly sends push notifications until the user approves one. Number matching practically eliminates it.

Defensive technology

EDR: Endpoint Detection and Response. Endpoint protection that looks for suspicious behaviour rather than only known malware, and enables intervention (killing a process, isolating a host).
XDR: EDR extended across more data sources: endpoint, network, mail, cloud. The aim is recognising the connected attack chain, not the isolated alert.
SIEM: Security Information and Event Management. Collects and correlates logs from multiple sources and raises alerts. It does not prevent attacks; it makes them detectable and reconstructable.
SOAR: Security Orchestration, Automation and Response. Automating the response to alerts through playbooks that handle routine steps without human action.
NGFW: Next-Generation Firewall. Sees applications, users and encrypted traffic content, not only ports and IP addresses.
WAF: Web Application Firewall. Sits in front of a web application and catches application-layer attacks such as injection and XSS.
IPS / IDS: Intrusion Prevention / Detection System. IPS intervenes and blocks; IDS only alerts.
NAC: Network Access Control. Identifying devices and checking their compliance state before admitting them to the network.
Sandbox: An isolated environment where a suspicious file or link can be executed and observed safely before reaching the user.
Allow-listing: Only pre-approved programs may run; everything else is blocked. The foundation of industrial defence, because it needs no daily updates and also stops zero-days.
Virtual patching: Network-level protection against an unpatchable vulnerability: the IPS blocks traffic targeting the flaw while the device itself stays untouched. Often the only realistic answer in OT.
Honeypot: A deliberately vulnerable-looking system placed as a trap to reveal an attacker's presence.

Identity and access

MFA: Multi-Factor Authentication. A second proof alongside the password. Methods differ by orders of magnitude: a hardware key is phishing-resistant, SMS is not.
FIDO2 / passkey: Cryptographic authentication where the key is bound to the domain, so real-time phishing proxies do not work against it. Today the strongest widely available method.
SSO: Single Sign-On. One sign-in across multiple applications. Its security benefit is that MFA and conditional access can be enforced in one place.
Least privilege: Everyone receives only the rights their work requires. In practice privileges accumulate over time, so regular review is needed.
Just-in-time access: Elevated privilege is not standing but activated on request, time-bound and justified. Substantially reduces the attack surface of admin accounts.
Conditional access: Evaluating sign-ins by context: device state, location, risk score. Non-compliant devices receive only limited access.
Zero Trust: A design principle: trust nothing by default, evaluate every access request individually regardless of origin. Not a product but an architecture.
Service account: A non-human account used for application-to-application authentication. Often runs with excessive rights and a never-rotated password, making it a favoured target.

OT and industrial systems

OT: Operational Technology. The systems controlling physical processes. Unlike IT, availability and human safety are the first priorities here.
ICS / SCADA: Industrial Control System / Supervisory Control and Data Acquisition. Industrial control systems and the software layer supervising them.
PLC: Programmable Logic Controller. The building block of industrial automation. Lifetime of 15-25 years, and typically not patchable during operation.
HMI: Human-Machine Interface. The operator's screen for supervising the process. Often runs on an obsolete operating system because the control software is certified only for that version.
SIS: Safety Instrumented System. Brings the process to a safe state in a hazardous situation. Never touched in the name of incident response.
Purdue model: The layered reference architecture for industrial networks (levels 0 to 5). The most important boundary sits between levels 3 and 4, where the industrial DMZ goes.
Industrial DMZ: A buffer zone between the office and plant networks. No traffic passes directly between the two; all exchange goes through intermediate systems here.
Zone and conduit: The core model of IEC 62443. A zone groups assets with equivalent security requirements; a conduit is the defined, restricted data path between zones.
Security Level (SL): IEC 62443's five-point scale for the capability of adversary a zone must withstand. Most industrial zones sit at SL 2, critical process control at SL 3.
Passive discovery: Building an asset inventory from traffic mirroring without sending packets. Mandatory in OT, because active scanning can knock over an older controller.
Modbus / DNP3 / S7comm: Industrial protocols. Designed for physically isolated networks, they carry no authentication or encryption: whoever reaches the network can issue commands.
Air gap: A physically isolated network. Rarely complete in practice: removable media and maintenance laptops bridge it regularly.

Process and measurement

CVE: Common Vulnerabilities and Exposures. The unique identifier of a known vulnerability, for example CVE-2024-12345.
CVSS: A score from 0 to 10 measuring theoretical severity. Misleading on its own, because it ignores whether the system is reachable and what it is worth commercially.
EPSS: Exploit Prediction Scoring System. Estimates the likelihood of exploitation in the next 30 days. A better prioritisation basis than CVSS.
KEV: Known Exploited Vulnerabilities. The CISA catalogue of vulnerabilities with confirmed active exploitation. Anything on it is immediate priority.
RTO: Recovery Time Objective. How quickly a service must be restored after an outage. To be set jointly with the business, not by IT alone.
RPO: Recovery Point Objective. How much data loss is acceptable. If backup runs daily, RPO is 24 hours.
MTTR: Mean Time To Repair / Respond. The key effectiveness indicator for vulnerability and incident management.
3-2-1-1-0: Backup rule: 3 copies, on 2 media types, 1 off site, 1 offline or immutable, and 0 errors on verified restoration.
Immutable backup: A copy that cannot be deleted before its retention expires, not even with administrative rights. A key element of ransomware defence.
Tabletop exercise: A discussion-based incident simulation walking through a scenario. Cheap, and it always surfaces the same gaps: a missing phone number, unclear decision authority.
Penetration test: A controlled attack by a human expert showing what an adversary actually achieves. It differs from a vulnerability scan in that findings are proven and chained.
Red team: A targeted, longer exercise measuring the organisation's detection and response capability rather than its vulnerabilities.
Compensating control: Alternative protection where the original measure (such as patching) cannot be applied. For example strict segmentation around an unpatchable system.

Networking

VLAN: Virtual LAN: logical separation over a single physical infrastructure. Not segmentation on its own, because if routing between layers happens without filtering, VLANs reach each other freely.
Micro-segmentation: Dividing the network into very small zones at application or workload level with strictly defined traffic. The strongest barrier to lateral movement, but substantial design work.
Client isolation: Machines in the user segment cannot reach each other, only servers and the egress point. Cheap, and blocks exactly the spread by which attacks progress.
Jump server: A single tightly controlled machine through which administrative access happens. All other paths are blocked, so it can be logged and defended in one place.
DMZ: A buffer zone between the internal network and the outside. In industrial settings it sits between IT and OT, and all data exchange passes through intermediate systems here.
NetFlow: Network traffic metadata: who communicated with whom, when, and how much. It carries no content but underpins the communication matrix and anomaly detection.
NDR: Network Detection and Response. Detection based on traffic analysis. Useful where no endpoint agent can be installed, such as OT environments.
East-west traffic: Traffic inside the network between servers and workstations, as opposed to north-south traffic to the internet. Attackers move in it, and it is typically the least monitored.
Port mirroring (SPAN): The switch copies traffic to a port for analysis. A passive method that does not affect network operation, so it is usable in OT environments too.
Network TAP: A physical device wired inline that copies traffic. More reliable than SPAN because it does not load the switch and works without packet loss.

Cloud and application

Shared responsibility: With a cloud provider, infrastructure security is theirs while data and configuration are yours. Most cloud incidents stem from customer-side misconfiguration.
CSPM: Cloud Security Posture Management. Continuously checks cloud configuration: exposed storage, over-broad permissions, missing encryption.
IAM: Identity and Access Management. The engine of cloud permissions. The most common mistake is an over-permissive policy nobody narrows after the project ends.
Secrets management: Storing and distributing passwords, API keys and certificates. If these sit in source code or config files, every developer and every backup contains them.
SAST and DAST: Static and dynamic application security testing. SAST analyses source code, DAST the running application. They complement rather than replace each other.
SBOM: Software Bill of Materials. An inventory of a software's components. Without it, when a new component vulnerability appears you cannot say whether your system is affected.
Container escape: The attacker breaks out of a container onto the host. Typically enabled by over-permissive runtime settings or a kernel vulnerability.
OWASP Top 10: A community list of the most common web application security flaws. Not a standard but a priority order, and most testing methodologies build on it.
Injection: The attacker passes a command disguised as data into an interpreter (SQL, shell, LDAP). Prevention is not input filtering but parameterised queries.
XSS: Cross-site scripting: the attacker injects a script into a page that runs in the visitor's browser, allowing session cookie theft or actions on their behalf.
CSRF: Cross-site request forgery: the attacker triggers an action on behalf of a signed-in user from another site. Defended with tokens and SameSite cookies.
Prompt injection: With language models, the attacker hides an instruction in data to divert the system from its original task. It cannot be fully eliminated, so defence rests on limiting the impact.

Cryptography

Symmetric encryption: The same key encrypts and decrypts (AES, for example). Fast, therefore suited to large volumes, but delivering the key securely is a separate problem.
Asymmetric encryption: A key pair: the public key encrypts, the private key decrypts. Slower, so typically used for key exchange and signatures rather than bulk data.
Hash: A one-way digest: a fixed-length value from arbitrary data. Not reversible, so used for integrity checking and password storage.
Salt: A random value added to a password before hashing. It prevents identical passwords producing identical hashes and renders precomputed tables useless.
HSM: Hardware Security Module. A physical device storing keys and performing cryptographic operations so the key never leaves it. For systems requiring high assurance.
PKI: Public key infrastructure: the system for issuing and revoking certificates. Often under-managed in enterprises, despite being an attack surface.
TLS: Transport Layer Security. Encryption of the network connection. Most traffic today is TLS, so a firewall sees inside only if it can decrypt.
Key rotation: Regular replacement of cryptographic keys. It limits the useful life of a compromised key and forces the process to work at all.
End-to-end encryption: Data is encrypted at the sender and decrypted only at the recipient. Intermediate systems, including the provider, cannot see the content.
Post-quantum cryptography: Algorithms resistant to quantum computers. It matters today for long-retention data, because data stolen now may be decrypted later.

Incident and forensics

IoC: Indicator of Compromise: a file hash, IP address, domain name or behavioural pattern pointing to a specific attack.
TTP: Tactics, techniques and procedures: a description of the attacker's methods. A more durable signal than IoCs, because attackers change IPs easily but methods rarely.
MITRE ATT&CK: A public knowledge base of known adversary techniques organised by phase. Used to measure detection coverage and identify gaps.
Dwell time: The period an attacker remains undetected in the network. Measured in weeks for years now, and it determines how long logs must be retained.
Memory image: A snapshot of a machine's memory. Critical in incident response, because running processes, network connections and sometimes the encryption key exist only here.
Evidence preservation: Keeping traces of an incident intact. The most common mistake is powering off or rebuilding the machine, which destroys evidence permanently.
Containment: Stopping the spread of an incident. Not the same as isolation: in industrial environments disconnecting a segment can halt the process, so it requires judgement.
Root cause analysis: Establishing how the attacker got in. Without it the restored system remains equally vulnerable and the attacker returns the same way.

Organisation and process

Attack surface: Everything through which an attacker might enter: exposed services, users, suppliers, physical access. Reducing it is cheaper than defending it.
Shadow IT: Systems and services introduced without IT's knowledge. It arises not from malice but because the official route is slow. Discovery starts from proxy logs.
Insider risk: Threat originating inside the organisation, whether deliberate or negligent. The negligent case is more common, and the same controls address it as an external attacker.
Principle of least surprise: A security control works when it is predictable for the user. Surprising or seemingly unjustified restrictions get bypassed, creating new risk.
Security baseline: A uniform, documented security configuration for systems. Without it every machine is unique and deviation cannot be identified.
Change management: Recording who changed what and when. In incident response this distinguishes attacker activity from a colleague's work.
Risk acceptance: A written decision not to treat a risk. A legitimate answer when somebody makes and signs it. Tacit neglect is not.
Security culture: The state where reporting is natural and not punished. It is measurable: report rate says more about an organisation than click rate.
Four-eyes principle: A critical operation (payment, granting access, configuration change) is approved by two people. Against invoice fraud it is worth more than any mail filter.
Security by design: Security requirements are part of design rather than bolted on afterwards. Retrofitting costs more, and some things can no longer be fixed at all.
Defence in depth: Multiple independent layers of protection. None is perfect, but the attacker must defeat all of them, and each layer buys the defender time and traces.
Security debt: Accumulated deferred security work: unpatched systems, temporary exceptions, undocumented workarounds. It compounds like technical debt.
Threat modelling: Structured thinking about who might attack a system, what, and how. In the design phase it is the cheapest security investment available.
Security control: A specific measure addressing a risk. Three types exist: preventive (stops), detective (alerts) and corrective (restores). All three are needed.