Glossary

156 terms from Endpoint and Application Security, in plain words, each with the chapter that teaches it.

Search the glossary

A

Active Directory (AD): Microsoft's directory service. It stores a company's users, computers and OUs, such as Kettle & Crane's domain ad.kettleandcrane.com, and is the base Group Policy works from.
AIDE (Advanced Intrusion Detection Environment): A free file integrity monitoring tool for Linux. It records hashes and attributes of watched files (--init), then reports added, removed or changed files (--check), such as the skimming script slipped into /srv/shop/checkout.html.
Alignment: DMARC's rule that SPF or DKIM must pass for the same domain shown in the From line. Mail that passes SPF and DKIM for kc-mailer.example but says From: orders@kettleandcrane.com fails DMARC.
Allow list: A list of what is permitted, with everything else refused (implicit deny). It is used for programs in application control and for input shapes in input validation.
Antivirus (AV): Software that checks files against signatures of known malware when files are written or opened, and on a schedule. It misses new malware that nobody has described yet, such as the new attachment Priya opened.
API key: A secret string that lets a program use an online service, such as an AWS cloud key. Anyone who finds one can act as its owner, so it must never sit in code.
App Control for Business: Windows' built-in application control, formerly called WDAC, and recommended for new policies. Alex uses it to allow-list the shipping workstation's programs by publisher and hash.
AppArmor: Ubuntu's simpler mandatory access control system, used instead of SELinux. sudo aa-status shows its profiles, and Ubuntu's bubblewrap package has an AppArmor profile that lets it build sandboxes.
Application control: Deciding which programs may run on a device at all, instead of searching for bad ones. Rules recognize programs by path, publisher or hash.
AppLocker: Windows' older application control tool. Like App Control for Business, it is deployed by Group Policy or an MDM.
attack surface: Everything on a machine an attacker could try to use: listening ports, installed software, accounts and loose settings. Hardening makes it as small as the machine's job allows.
Audit mode: A policy setting that only logs what it would block. Alex ran the workstation's allow list this way for two weeks and found Jo's weekly report tool before enforcing.
Authenticode: Microsoft's code signing system for Windows programs, applied and checked with the `signtool` command. It proves who published a program and that it hasn't changed since it was signed, though not that it is safe.
Automated enrollment: Company-bought devices joining the MDM by themselves at first start, because the reseller registered their serial numbers. Removing the profile or wiping the phone doesn't escape it.
AVC (access vector cache): An SELinux denial message in /var/log/audit/audit.log. It names the source context (scontext), the action, and the target context and class (tcontext, tclass).

B

Bandit: A free static code analyzer for Python. It flagged the contractor's labels.py for a hardcoded password, SQL built from strings, shell=True, MD5 and debug mode.
Behavior-based detection: Spotting attacks by what programs do, such as a document starting PowerShell or a program running from /tmp, rather than by known files. It catches new malware but also raises false alarms.
BIMI (Brand Indicators for Message Identification): A DNS record at default._bimi.DOMAIN that makes mail apps show the company's logo next to its messages. It is a reward for authentication, not a check, and needs DMARC at quarantine or reject.
BitLocker: Windows' full-disk encryption. The TPM keeps its key and releases it only to an unchanged boot.
Block inheritance: An OU setting that stops GPOs linked to the site, the domain and parent OUs from reaching it. An Enforced link still gets through.
Boolean (SELinux): A named on/off switch in the SELinux policy for an optional behavior, such as httpd_can_network_connect_db, which lets a web server connect to a database.
bubblewrap (bwrap): A Linux tool that builds sandboxes from kernel namespaces. sandbox.sh uses it to give risky.sh read-only programs, an empty /tmp, no home folder and no network.
Build pipeline: The automatic steps that turn code into a deployed release. In release.sh these are static analysis, a secrets scan, packaging and signing, and the release stops at the first failure.
BYOD (bring your own device): An ownership model in which staff use their own phones for work. The MDM manages only a work area, which a selective wipe can remove, as Kettle & Crane does for everyone's email.

C

Canary: A small tripwire that calls home when touched, such as a unique link in supplier-prices-Q4.txt that appears nowhere else. A honeytoken is a canary made of data.
Canarytokens: A free service that makes ready-made canaries and honeytokens and alerts you when they are used.
CI/CD: Continuous integration and continuous delivery/deployment: automated build pipelines that test, package and deploy code every time it changes. Security steps such as static analysis, secrets scanning and code signing can run in it automatically, so nobody has to remember them.
CIS Benchmarks: Published hardening guides from the Center for Internet Security, used as a starting point when you establish a secure baseline.
ClamAV: A free antivirus scanner for Linux. You can give it your own hash (.hsb) and pattern (.ndb) signature files.
Code signing: Signing a release with a private key so servers can verify, with the public key, who built it and that it hasn't changed. It doesn't prove the code is safe, and the signing key must be guarded.
command injection: Building a shell command from user input so an attacker can add commands of their own. Bandit flags it as subprocess with shell=True.
Compliance (MDM): Whether a device meets the policy: encrypted, passcode set, OS recent, not jailbroken, and checking in. compliance.py found that Sam's BYOD-09 failed three rules.
Computer Configuration: The half of a GPO applied to machines, at startup and about every 90 minutes, such as firewall and USB rules. Its files are in the GPO's Machine folder.
Conditional access: Blocking non-compliant devices from company services such as email or the order system until they are fixed.
Configuration profile: An Apple settings file, a property list, made of payloads and pushed by an MDM. passcode.mobileconfig holds Kettle & Crane's passcode rules.
COPE (corporate-owned, personally enabled): Company-owned phones that also allow personal use in a separate area, like Sam's market card-payment phone.
Core dump: A crashed program's memory saved to disk, which can include passwords. harden.sh stops them with the line '* hard core 0'.
CSRF (cross-site request forgery): An attack in which another site's form makes the customer's browser send a request, such as an order, with their cookie. The SameSite flag stops it.
CYOD (choose your own device): Company-owned devices, controlled like COPE, where the user picks a model from an approved list.

D

Data loss prevention (DLP): Tools that stop sensitive data, such as card numbers, leaving by USB, upload or email. Blocking USB disks in harden.sh is a small example.
debug mode: A developer setting that shows detailed error pages with paths, versions and code. It must be off on a live server; Bandit and Semgrep both flag Flask's debug=True.
Deception: Planting decoys that look valuable but that no honest person or program touches, so any touch signals an intruder and false alarms are rare.
Default passwords: Factory passwords such as admin/admin on printers and cameras, which attackers try first. Change them before the device is used.
Deny list: A list of what is refused, with everything else allowed. It is easy to start, but every new piece of malware or dangerous input is allowed by default.
Discretionary access control (DAC): Access control where each file's owner decides who may read, write or run it, using chmod. Root ignores it completely.
Distinguished name (DN): A directory entry's full name, read from left to right as 'inside'. OU=Office,DC=ad,DC=kettleandcrane,DC=com is the Office OU in ad.kettleandcrane.com.
DKIM (DomainKeys Identified Mail): A digital signature the sending server adds to each email in a DKIM-Signature header. Receivers check it with the public key at SELECTOR._domainkey.DOMAIN, and any change to the signed body or headers breaks it.
DMARC (Domain-based Message Authentication, Reporting and Conformance): A DNS record at _dmarc.DOMAIN that ties SPF and DKIM to the visible From domain, says what to do with mail that fails, and asks receivers for reports.
Domain controller (DC): The server that runs a Windows (Active Directory) domain: it stores users, computers and OUs, checks sign-ins, and pushes Group Policy to domain-joined computers. Samba can also act as one, as in a lab DC at 192.168.20.5.
Drift: Settings that have changed since a baseline was applied. Maintaining a baseline means checking for it.

E

EDR (endpoint detection and response): Agents that record each endpoint's processes, files, connections and logins, detect suspicious behavior, and respond by killing, quarantining or isolating. EDR caught the PowerShell chain from Priya's attachment.
EICAR test file: A harmless standard file that every antivirus reports as malware, used to test scanners safely. In the lab it is disguised as invoice.pdf.exe.
Endpoint: Any device people or programs use at the end of a network connection, such as a laptop, a server or a phone.
Enforced (GPO link): A GPO link whose settings win over everything below it, even through block inheritance. Alex enforces the KC Office Baseline so the Sales OU can't loosen the screen lock.
Enrollment: Joining a device to an MDM by installing a management profile that names the MDM the device trusts.
envelope sender: The sender given in the SMTP conversation (MAIL FROM), which can differ from the From: line people see. SPF checks this domain.

F

Fail2ban: A free, log-watching HIPS. When one address fails too often, for example 5 failed SSH logins in 10 minutes, it bans that address in the host firewall.
false positive: An alert on something harmless, such as a developer testing a program in /tmp. Blocking tools that act on a false positive stop real work.
File integrity monitoring (FIM): Recording each watched file's hash while the system is known to be good, then comparing later to catch changes such as a skimming script added to a checkout page.
FileVault: macOS full-disk encryption.
Filter (Fail2ban): A set of patterns that recognize one program's log lines, such as failed SSH logins.
Flask: A Python web framework. shop.py uses it: @app.get('/search') runs a function for GET requests to /search, and abort(400) rejects a bad request.

G

Gatekeeper: macOS application control. It allows only App Store apps or apps from identified developers that Apple has checked.
git history: Git, the version-control tool, keeps every commit, so a deleted file stays readable in old commits for anyone who clones the repository. That is why a leaked secret must be revoked.
Gitleaks: A free secrets scanner. gitleaks git scans every commit in a repository and gitleaks dir scans plain files; it found the fake AWS keys in shop-repo's history.
GPO (Group Policy Object): A named bundle of Windows settings in two halves, Computer and User Configuration. It does nothing until it is linked to a site, domain or OU, like the KC Office Baseline.
gpresult: A Windows command that shows which GPOs applied: /r lists them, and /h report.html saves every setting with the GPO that won it.
gpupdate: A Windows command; gpupdate /force applies all GPOs immediately instead of waiting.
Group Policy: Central management of Windows settings in a domain: the domain controller pushes settings to every computer and user. Most companies deploy a Windows baseline this way.
Group Policy Management Console (GPMC): The Windows tool for creating, editing and linking GPOs on an admin PC.
GUID (globally unique identifier): The unique ID in braces that is a GPO's real name, such as {31B2F340-016D-11D2-945F-00C04FB984F9} for the Default Domain Policy.

H

Hardening: Shrinking a device's attack surface: remove what its job doesn't need, then set safe values for everything that stays.
Hardening index: Lynis's score from 0 to 100. On the shop server it rose from 63 to 71 after the baseline, though the score never noticed port 8000.
Hash signature: An antivirus signature that matches one exact file by its hash. In ClamAV it is written HASH:SIZE:NAME. Changing a single byte of the file defeats it.
Heuristics: Antivirus rules about suspicious features, such as hidden packed code, rather than matches to known files.
HIDS (host-based intrusion detection system): Software on one host that watches from inside, using file integrity, logs and system state, and alerts on signs of attack.
High-interaction honeypot: A real, deliberately weak system that records an attacker's every keystroke. It teaches more than a low-interaction one but must be isolated so it can't become the attacker's base.
HIPS (host-based intrusion prevention system): A HIDS that also acts: it blocks an address, stops a process or refuses a change. Fail2ban is one.
Honeyfile: A decoy file with a tempting name, such as passwords.txt on the office share, that is watched for access.
Honeynet: Several honeypots forming a fake network, such as a fake 'warehouse' subnet, behind a firewall that lets attackers in but not out.
Honeypot: A fake system that records whoever uses it, such as honeypot.py's fake SSH server on port 2222. It can be low or high interaction.
Honeytoken: Fake data or credentials that alert when used, such as the cloud key in backup-credentials.txt that grants nothing and fires an alert wherever the intruder tries it.
Host-based firewall: A firewall that runs on the endpoint itself, so it still protects a laptop on café Wi-Fi. On the shop server it is ufw.
HttpOnly: A cookie flag that stops JavaScript in the page from reading the cookie, so an XSS script can't steal it.

I

implicit deny: The rule that anything not explicitly allowed is refused, as in an allow list or a firewall's last rule.
Inotify: The Linux feature that lets a program ask the kernel to report events on a file, such as someone opening it.
Input validation: Checking on the server that each input has the expected type, length, range, format and membership, and rejecting the rest. The shop's search allows only 1 to 30 letters, digits, spaces or hyphens.
Intune: Microsoft's MDM, which manages phones, tablets and laptops from one console.
Isolate the host: An EDR action that cuts a device off from everything except the EDR console while you investigate, as was done with Priya's laptop.

J

Jail (Fail2ban): A Fail2ban filter joined to a ban action and limits, set in a .local file under /etc/fail2ban/jail.d/. An example is the sshd jail that bans after 5 failures in 10 minutes.
jailbroken or rooted: An iPhone (jailbroken) or Android phone (rooted) with the system's protections removed. Its own reports can't be trusted, so the MDM treats it as non-compliant, as with Sam's BYOD-09.

L

LAPS (Windows): Windows Local Administrator Password Solution: gives each laptop's local admin account a different random password, stored in the directory, so one stolen password doesn't open every laptop.
Link (GPO): Attaching a GPO to a site, domain or OU so that everything inside receives it. samba-tool gpo setlink creates a link.
LSDOU: The order Windows applies GPOs in: local, site, domain, then OUs from the top down. The last one applied wins a conflict unless a higher link is Enforced.
Lynis: A free, read-only security auditing tool for Linux and macOS. It runs a few hundred checks and gives a hardening index plus warnings and suggestions.

M

Mandatory access control (MAC): An administrator's policy, enforced by the kernel, that owners can't change and even root processes obey. An action needs both DAC and MAC to say yes.
MDM (mobile device management): Software that manages phones, tablets and laptops from one console: it pushes settings and apps, checks compliance, and locks or wipes devices.
Measured boot: Each boot step records a hash of the next step in the TPM. A changed boot loader gives different hashes, so keys such as BitLocker's stay locked.
Mechanism (SPF): A part of an SPF record that names allowed senders: mx (the domain's mail servers), ip4: (an address or range), a (the addresses of the domain's own name), or include: (another domain's list).
Modes (SELinux): SELinux runs in one of three modes. Enforcing denies and logs; permissive only logs what it would deny, for short tests; disabled turns it off and stops labeling files.

N

noexec: A mount option that makes Linux refuse to run any program from that file system. It is a good default for USB sticks and folders anyone can write to.
notarization: Apple's automated malware check of apps signed with a Developer ID certificate. Gatekeeper allows notarized apps from identified developers to run.

O

Organizational unit (OU): A folder of users and computers in the directory, such as OU=Office with Priya in it. GPOs can be linked to it.
Output encoding: Replacing characters that have special meaning, such as < becoming <, when text goes into a page, so a review is shown and never run as code.

P

parameterized query: A database query where input is passed separately, for example as a ? parameter, so it can never become SQL even if validation is too loose.
Password guessing (brute force): Trying many passwords against a login, such as five failed SSH logins in eight seconds from 203.0.113.77. Fail2ban stops it by banning the address.
Patch management: The plan behind updates: test a fix on one machine, roll it out within a set time, and check that every machine got it.
Pattern signature: An antivirus signature that matches a short run of bytes inside a file, so small changes elsewhere don't defeat it. In ClamAV it is written NAME:TYPE:OFFSET:HEX.
Payload: One area of settings in a configuration profile, such as com.apple.mobiledevice.passwordpolicy for passcode rules.
Policy (DMARC): What receivers do with mail that fails DMARC: none (deliver and report), quarantine (spam folder) or reject (refuse). Move from none to reject step by step using the reports.
Pre-commit hook: A script git runs before each commit, for example Gitleaks refusing commits that hold secrets.
private key and public key: A matched key pair: the private key, kept secret, signs; the public key, shared, verifies. The build signs with release.key and servers verify with release.pub.

Q

Quarantine: Moving a suspect file somewhere it can't run but can still be studied or restored, as clamscan --move did with invoice.pdf.exe. In DMARC, quarantine instead means putting failing mail in the spam folder.

R

ransomware: Malware that encrypts a victim's files and demands payment to unlock them. EDR spots it by behavior, such as hundreds of files renamed in a minute.
restorecon: Resets files to the SELinux label the policy expects for their path, fixing pages moved with mv from a home folder.
rua: The DMARC tag giving the address where receivers send daily aggregate reports, such as mailto:dmarc@kettleandcrane.com.
Rule types (application control): The three ways application control recognizes a program: a path rule matches a folder, a publisher rule matches a vendor's signature, and a hash rule matches one exact file. They run from weakest to strongest, and real policies mix them.

S

SameSite: A cookie flag that stops the cookie being sent with requests started by other sites' forms, which blocks CSRF.
Sandboxing: Running untrusted code, such as a supplier's tool or an attachment, in isolation so it sees only what you hand it and any damage stays inside.
Secret: Anything that grants access, such as a password, an API key or a private key. Keep secrets in environment variables or a secrets manager, never in code.
Secrets scanning: Searching code and its whole git history for secrets. When one leaks, revoke and replace it first, because deleting the file leaves it in old commits.
Secure (cookie flag): A cookie flag that sends the cookie only over HTTPS, so someone reading café Wi-Fi traffic can't steal it.
Secure baseline: The documented settings every machine of one kind must have, such as 'the shop server'. It is established from a guide, deployed the same way everywhere, and maintained against drift.
Secure Boot: A UEFI firmware feature that starts only boot loaders signed by a trusted key, so malware can't start before the operating system.
Secure cookie: A cookie sent with the Secure, HttpOnly and SameSite flags, as shop.py sets for Flask's session cookie.
Security baselines (Microsoft): Ready-made GPOs of recommended Windows settings, published free in Microsoft's Security Compliance Toolkit. Import one, test it, then link it widely.
Security context: The SELinux label on every process and file, written user:role:type:level, such as system_u:object_r:httpd_sys_content_t:s0.
Selective wipe: Removing only the work data, such as the work profile, from a device and leaving personal photos alone, as Alex did with Sam's phone.
Selector (DKIM): The name (s=) showing where a DKIM public key is published. Selector mail puts the key at mail._domainkey.kettleandcrane.com.
SELinux (Security-Enhanced Linux): The Linux kernel's mandatory access control system, on by default in RHEL and Android. It labels everything and allows only listed type pairs, so a hijacked web server stays confined.
semanage fcontext: Records the SELinux label a path should have, such as httpd_sys_content_t for /srv/shop, so restorecon can apply it lastingly.
Semgrep: A static analyzer for many languages that takes your own code-shaped rules, such as kc-sql-built-from-strings matching $DB.execute("..." + $X).
session cookie: The cookie a web app uses to recognize a logged-in user, so stealing it means stealing the login. Flask signs it, but its contents can still be decoded.
setsebool: Turns an SELinux boolean on or off; -P keeps the change after reboot. getsebool -a lists all booleans.
SIEM (security information and event management): A system that collects and analyzes logs from everything. Unlike XDR, it isn't one vendor's tools with built-in responses.
Signatures: Descriptions of known malware that antivirus checks files against. They only find malware someone has already described.
Software bill of materials (SBOM): A list of every component and version in a release, like a food label's ingredients. When a library flaw is announced, it shows which releases contain it.
SPF (Sender Policy Framework): A TXT record on the domain listing the servers allowed to send mail for it, checked against the envelope domain. Kettle & Crane's reads v=spf1 mx ip4:198.51.100.40 -all.
SQL injection: An attack in which input is treated as database code, such as x' UNION SELECT password FROM users--. Validation and parameterized queries stop it.
Static code analysis: Finding risky patterns in source code without running it. It is fast and covers every line, but expect false positives and missed logic flaws.
SUID: A file mode that makes a program run as its owner rather than as the user who starts it, as passwd does. A buggy SUID-root program is a way to become root, so review them.
Sysmon: A free Microsoft tool that logs detailed process and file events on Windows.
SYSVOL: The share on every domain controller that holds GPO files, with one folder per GPO containing Machine, User and GPT.INI.

T

TPM (Trusted Platform Module): A small security chip on the motherboard that holds keys such as the BitLocker key and boot measurements, and releases keys only to an unchanged boot.
Trust boundary: Where data passes from something you don't control, such as a customer's request, into code you do. Every check that matters runs there, on the server.
Type (SELinux): The third part of an SELinux context, such as httpd_t for the web server or user_home_t for home files. Policy rules allow access between types.
Type enforcement: SELinux allowing access only between listed type pairs, such as httpd_t reading httpd_sys_content_t, and denying everything else.

U

ufw: Ubuntu's simple front end to the kernel firewall. ufw default deny incoming plus ufw allow 22/tcp makes a host-based firewall.
Umask: The permissions new files don't get. With 027, a file requested as 666 becomes 640 (rw-r-----).
User Configuration: The half of a GPO applied to people when they sign in, on any computer, such as the screen saver timeout.
User enrollment: The owner enrolling a personal device by installing the company app or profile. Only a separate work area is managed.

W

Wazuh: A free, open-source HIDS and XDR platform that combines file integrity, log rules and central alerting.
Wipe: Erasing a lost device remotely through the MDM, either all of it (full wipe) or only the work data (selective wipe).
Work profile: A separate, encrypted, managed work area on a personal phone. The MDM can't see the personal side, and a selective wipe removes only this area.

X

XDR (extended detection and response): Joins endpoint, email, network, identity and cloud data into one incident and responds across all of them. For Priya's case it deleted the email everywhere and disabled her account.
XSS (cross-site scripting): An attack in which text a user typed runs as script in another visitor's browser. Output encoding prevents it, and HttpOnly stops it stealing cookies.