Uphill Security

Access Control

Restricting system access to authorized users only

Advanced Encryption Standard

Symmetric block cipher for encrypting sensitive data

Advanced Persistent Threat

Sophisticated threat actors conducting prolonged targeted attacks

Backdoor

Hidden method for bypassing normal authentication

Baiting

Offering something enticing to trick victims

Bind Shell

Listener on target system waiting for attacker connection

Blue Team Operations

Defending against attacks and improving security posture

Botnet

Network of compromised computers controlled remotely for malicious purposes

Buffer Overflow

Writing data beyond buffer boundaries to corrupt memory

Burp Suite

Integrated platform for web application security testing

Canary Token

Planted artifact that alerts when accessed by attackers

Common Vulnerabilities and Exposures

Dictionary of publicly known security vulnerabilities

Common Vulnerability Scoring System

Standardized method for rating vulnerability severity

Common Weakness Enumeration

Community-developed list of software and hardware weakness types

Confidentiality Integrity Availability Triad

Fundamental model for information security policies

Cross-Site Request Forgery

Forcing authenticated users to execute unwanted actions on web applications

Cross-Site Scripting

Injecting malicious scripts into web pages viewed by other users

Cryptographic Hash Function

One-way function generating fixed-size output from variable input

Data Exfiltration

Unauthorized transfer of data from compromised systems

Data Loss Prevention

Preventing unauthorized access and transmission of sensitive data

Defense in Depth

Layered security approach using multiple defensive mechanisms

Denial of Service

Overwhelming system resources to make services unavailable

Digital Forensics

Investigating and analyzing digital evidence from security incidents

Discretionary Access Control

Resource owners controlling access to their resources

Distributed Denial of Service

Coordinated DoS attack from multiple sources simultaneously

Domain Name System

Hierarchical system that translates domain names to IP addresses

Dynamic Application Security Testing

Testing running applications for security vulnerabilities in real-time

Endpoint Detection and Response

Monitoring and responding to threats on endpoint devices

Enumeration

Extracting detailed information about systems and services

Exploit

Code or technique taking advantage of security vulnerabilities

Firewall

Network security system controlling incoming and outgoing traffic

General Data Protection Regulation

EU regulation on data protection and privacy

Health Insurance Portability and Accountability Act

US law establishing data privacy standards for healthcare information

Honeypot

Decoy system designed to attract and detect attackers

Incident Response

Structured approach to handling security breaches and attacks

Insecure Direct Object Reference

Accessing unauthorized objects by manipulating direct references

Insider Threat

Security risk from individuals with authorized access

Interactive Application Security Testing

Real-time security testing during application runtime using instrumentation

Intrusion Detection System

Monitoring network traffic for suspicious activity and known threats

Intrusion Prevention System

Actively blocking detected threats in network traffic

ISO/IEC 27001

International standard for information security management systems

JSON Web Token

Compact token format for securely transmitting information between parties

Kali Linux

Debian-based Linux distribution designed for penetration testing

Keylogger

Software that records keystrokes to capture sensitive information

Lateral Movement

Moving through network to reach additional systems

Local File Inclusion

Including local files on server through vulnerable input validation

Man-in-the-Middle Attack

Intercepting communication between two parties without their knowledge

Mandatory Access Control

Access control based on classification levels and clearances

Metasploit Framework

Penetration testing framework for developing and executing exploits

Multi-Factor Authentication

Requiring multiple verification methods to confirm user identity

National Institute of Standards and Technology

US agency developing cybersecurity standards and guidelines

Network Mapper

Open-source tool for network discovery and security auditing

Open Authorization

Authorization framework for delegating access without sharing credentials

Open Web Application Security Project

Nonprofit foundation focused on improving software security

Password Salt

Random data added to passwords before hashing to prevent rainbow tables

Patch Management

Process of applying updates to address vulnerabilities

Payload

Malicious code delivered and executed by an exploit

Payment Card Industry Data Security Standard

Security standard for organizations handling credit card information

Phishing

Fraudulent attempts to obtain sensitive information through deceptive communications

Pretexting

Creating fabricated scenario to obtain information

Principle of Least Privilege

Granting minimum access rights necessary for task completion

Privilege Escalation

Gaining higher access privileges than originally granted

Public Key Infrastructure

Framework for managing digital certificates and public-key encryption

Purple Team Operations

Collaboration between red and blue teams for improvement

Ransomware

Malware that encrypts data and demands ransom for decryption

Reconnaissance

Gathering information about target before attack

Red Team Operations

Simulating adversary tactics to test defensive capabilities

Remote Code Execution

Executing arbitrary code on a remote system through vulnerability exploitation

Remote File Inclusion

Including remote files through vulnerable input allowing code execution

Remote Internal Penetration Testing

Simulating insider attacks on internal network infrastructure remotely

Reverse Shell

Connection from target system back to attacker's machine

Risk Assessment

Identifying and evaluating security risks to assets

Rivest-Shamir-Adleman

Asymmetric cryptographic algorithm for encryption and digital signatures

Role-Based Access Control

Assigning permissions based on user roles

Rootkit

Malware designed to hide its presence and maintain privileged access

Sandbox

Isolated environment for safely executing untrusted code

Scanning

Automated probing of systems to identify vulnerabilities

Secure Sockets Layer

Deprecated predecessor to TLS for encrypted network communications

Security Assertion Markup Language

XML standard for exchanging authentication and authorization data

Security Audit

Comprehensive evaluation of security controls and policies

Security Information and Event Management

Centralized platform for collecting and analyzing security events

Security Operations Center

Centralized unit monitoring and responding to security incidents

Server-Side Request Forgery

Forcing server to make requests to unintended locations

Single Sign-On

Authenticating users across multiple applications with one login

Social Engineering

Manipulating people to divulge confidential information

Spear Phishing

Targeted phishing attack against specific individuals or organizations

SQL Injection

Injecting malicious SQL code to manipulate database queries

Static Application Security Testing

Analyzing source code for security vulnerabilities without executing it

System Hardening

Securing system by reducing vulnerabilities and attack surface

Tailgating

Gaining physical access by following authorized person

Threat Hunting

Proactively searching for hidden threats in the environment

Threat Modeling

Identifying and analyzing potential security threats systematically

Transport Layer Security

Cryptographic protocol for secure communication over networks

Trojan Horse

Malicious software disguised as legitimate programs

Virtual Private Network

Encrypted tunnel for secure communication over public networks

Vulnerability Assessment

Systematically identifying security weaknesses in systems

Web Application Firewall

Filtering and monitoring HTTP traffic to protect web applications

Web Shell

Script uploaded to web server for remote command execution

Wireshark

Network protocol analyzer for capturing and inspecting packet data

XML External Entity

Exploiting XML parsers to access local files or perform SSRF attacks

Zero Trust Security Model

Security framework requiring verification for every access request

Zero-Day Vulnerability

Previously unknown vulnerability with no available patch