Glossary

152 terms from Network Security, in plain words, each with the chapter that teaches it.

Search the glossary

#

802.1Q tag: A small label added to each frame on a trunk link that carries the frame's VLAN number, so the device at the other end knows which VLAN the frame belongs to.
802.1X: A standard for logging in at the network edge, before a device may use a switch port or Wi-Fi network. WPA3 Enterprise uses it so each staff member has their own login.

A

accept: A firewall action that lets a matching packet through.
access point: A device that connects Wi-Fi clients to the network over radio. It announces itself with beacon frames that carry its SSID and BSSID.
access port: A switch port that belongs to a single VLAN. The connected host's frames join that VLAN, and the host never sees a VLAN number.
ACL: Access control list: an ordered list of allow and deny rules on a router or firewall that decides what may pass, for example between VLANs.
adaptive identity: In zero trust, checks that get stricter as a request becomes riskier. A new device or a sensitive page such as /admin needs more proof.
AH: Authentication Header: the part of IPsec that protects a packet's integrity but does not encrypt it.
air gap: Complete separation with no network connection of any kind, not even Wi-Fi or Bluetooth, as for Kettle & Crane's roaster control PC. Removable media such as USB sticks then become the main risk.
anomaly scoring: The way the OWASP CRS decides: each rule that matches adds points to a request, and once the total reaches a threshold (5 in the lab) the request is blocked with 403.
anomaly-based detection: Detection that learns what normal traffic looks like and alerts on anything unusual, such as the shop server starting outbound connections. It can catch new attacks, but unusual is not always bad.
ARP: The protocol a device uses to find the MAC address for an IP address on its local network, by broadcasting a question such as "who has 192.168.20.12?". Broadcasts reach only ports in the same VLAN.
ARP poisoning: An on-path attack that sends fake ARP replies so traffic for one IP address goes to the attacker's MAC address. Dynamic ARP Inspection stops it.
attack surface: Everything an attacker can reach and try, such as open ports, services, login pages and devices. Alex measures Kettle & Crane's with nmap from the internet.

B

beacon frame: A frame each Wi-Fi access point broadcasts several times a second. It announces the SSID, BSSID, channel and security, but nothing in it proves it is genuine.

C

CASB: Cloud access security broker: the part of SSE that sees and controls how staff use cloud apps, such as unapproved shadow IT, public file shares and data sent to personal accounts.
chain: In nftables, an ordered list of rules attached to a hook such as input or forward, plus a policy for packets that match no rule.
CIA triad: The three goals of security: confidentiality, integrity and availability. Choosing fail-open or fail-closed means deciding which of them matters most for a given traffic.
clientless: A TLS VPN that needs no installed software. The user reaches selected internal web apps through a portal in the browser.
connection tracking: The kernel's table of every connection passing through the firewall. It gives each packet a state (new, established, related or invalid), which makes stateful filtering possible.
console server: A device wired to each server's or switch's serial console. It lets admins reach the devices over the out-of-band network even when the production network is down.
content filter: A control, usually on a forward proxy, that decides which websites staff may reach by domain, URL or category. Kettle & Crane's Squid blocks .bet.example this way.
control plane: The deciding half of a zero trust architecture. It holds the policy engine and the policy administrator, which choose whether each request is allowed.
ct state: An nftables match on a packet's connection-tracking state. The rule ct state established,related accept, placed first, lets every reply to an allowed connection back in.

D

data plane: The half of a zero trust architecture that carries traffic and enforces decisions, through policy enforcement points placed in front of each resource.
DDoS: A flood of traffic from many sources that tries to overwhelm a service. Large floods fill the internet line, so they need a protection service upstream rather than local rate limiting.
deauthentication attack: Sending forged Wi-Fi disconnect frames in an AP's name so devices drop off. They often reconnect to a nearby evil twin. Protected management frames defeat it.
device placement: Putting each security device where it can see and control the right traffic. For example, firewalls go at zone boundaries, the WAF goes in front of the shop, and an IPS goes inline.
DHCP snooping: A switch protection that trusts only the ports where the real DHCP server lives and drops DHCP offers from any other port, so a rogue DHCP server can't hand out a fake gateway.
DMZ: A zone between the internet and the inside network for servers the internet must reach, like Kettle & Crane's shop. If the shop server is broken into, the attacker still isn't inside the office.
dnat: An nftables NAT action that rewrites a packet's destination. Kettle & Crane uses it to forward port 80 on the public address to the shop server.
DNS: The service that turns names into IP addresses. Office lookups use UDP port 53, so the firewall allows that port outbound.
drop: A firewall action that throws a packet away silently, so the sender hears nothing and waits until it gives up. In Suricata, drop also blocks the packet.
Dynamic ARP Inspection: A switch protection that uses DHCP snooping's records of which MAC got which IP to drop ARP replies that don't match. This stops ARP poisoning.

E

end-to-end encryption: Encryption that only the final recipient can decrypt, so no device in between, not even the VPN concentrator, can read the data. SSH and HTTPS keep data encrypted all the way to the server, while a VPN protects only the stretch to the office.
ESP: Encapsulating Security Payload: the part of IPsec that encrypts packets and protects their integrity.
evil twin: A fake access point that copies a real network's SSID, such as KC-Staff, often with no password or a stronger signal, so devices connect to it and the attacker sits on their path.

F

fail-closed: A failure mode in which a broken device stops all traffic. Nothing unchecked gets through, but the business stops too: security is kept and availability is lost.
fail-open: A failure mode in which a broken device lets traffic keep flowing without inspection: availability is kept and security is lost. Alex picks it, with an alert, for the inline IPS.
failure mode: What a security device in the traffic path does when it can no longer inspect traffic. It either fails open or fails closed.
false negative: A real attack that raised no alert.
false positive: An alert or block for harmless traffic. An example is a customer's search for a "union select" coffee blend, flagged as SQL injection by Suricata and the WAF.
firewall: A device or program that decides, packet by packet, which traffic may pass between networks by comparing each packet with an ordered list of rules. Kettle & Crane's fw sits at every zone boundary.
firewall rule: One line of a firewall's list: a match that says which packets (interface, addresses, protocol, port) and an action (accept, drop or reject) for them.
first match wins: Firewall rules are checked from the top, and the first rule that matches decides. Rules below it are never read for that packet, so specific rules must come before broad ones.
forward proxy: A proxy that acts for clients. Staff browsers send their requests to it and it fetches the pages, so the office can filter and log browsing.
full tunnel: A VPN setup that sends all of a device's traffic through the tunnel (allowed-ips 0.0.0.0/0), so it passes the office's security devices, at a cost in bandwidth and speed.
FWaaS: Firewall as a service: a cloud-hosted firewall for branches and remote users, and one part of SSE.

H

HIDS: A host-based intrusion detection system: it watches one computer's files, logs and activity for signs of attack, rather than watching network traffic as a NIDS does.
high availability pair: Two identical devices where a standby takes over within seconds if the active one fails, so a single failure doesn't force a fail-open or fail-closed choice.
honeypot: A decoy system that looks real to attackers but holds nothing real, placed in the DMZ or its own zone to catch attackers.
hook: A point in a packet's path where an nftables chain attaches: mainly input (to the firewall itself), forward (passing through) and output (sent by it). NAT uses prerouting and postrouting, and netdev uses ingress and egress.

I

ICMP: The protocol for network error and control messages, such as the "unreachable" message a reject rule sends, and the echo messages ping uses.
iDRAC: A server's built-in management controller (iDRAC on Dell, iLO on HPE). It has its own network port, which connects to the out-of-band management network.
IDS: Intrusion detection system: it inspects traffic or activity and raises an alert when something looks malicious, by matching a known pattern or spotting unusual behavior. It does not block anything.
IKE: Internet Key Exchange: the part of IPsec that authenticates both ends and agrees keys, on UDP ports 500 and 4500.
implicit deny: Refusing everything that no rule explicitly allows. In nftables this is policy drop; on devices without a policy line, you add a final "deny any any" rule.
implicit trust zone: The area behind a zero trust policy enforcement point, where requests are trusted. It should be kept small, ideally a single app.
inline: Placed in the traffic's path, so all packets pass through the device. An inline IPS can drop attacks, but it adds delay and becomes a point of failure.
IPS: Intrusion prevention system: it does the same checks as an IDS but sits inline in the traffic's path, so it can also drop bad packets.
IPsec: A set of standards that secure packets at the IP layer. It is the classic choice for site-to-site VPNs and uses IKE, ESP and AH in tunnel or transport mode.

J

jump host: One hardened machine in the management zone that admins log into first. Only from it can they reach admin ports, so there is one door to watch and protect.

L

lateral movement: An attacker who controls one device moving sideways to reach others, like an infected laptop going for the order database. Segmentation limits it.
layer 4 firewall: A firewall that filters only on addresses, protocols and ports. It can't tell a real browser on port 443 from malware tunneling out on 443.
layer 7 firewall: A firewall that also looks inside traffic to recognize the application. It is usually sold as a next-generation firewall.
load balancer: A device that spreads requests over several web servers. It is placed in the DMZ in front of them.
logical segmentation: Separating networks by configuration on shared hardware, using VLANs, subnets and ACLs. It is cheap and flexible, but one wrong command can merge segments.

M

MAC table: A switch's list of which MAC address it learned on which port, stored per VLAN. A WIPS also checks it to see whether an unknown AP is plugged into your wired network.
masquerade: An nftables NAT action that rewrites outgoing packets to the firewall's public address, so the whole office shares 203.0.113.10.
ModSecurity: A WAF engine that runs as an nginx module and checks every HTTP request against rules such as the OWASP Core Rule Set.

N

NAT: Rewriting addresses as packets pass the router. The office shares one public address, and port 80 on it is forwarded to the shop server.
network tap: A device spliced into a cable that copies all its traffic to a passive sensor.
next-generation firewall: A layer 7 firewall that recognizes applications and users and often includes an IPS. It needs more processing power and is usually aimed at larger networks than a UTM.
NFQUEUE: The Linux mechanism that queues packets for a program, such as Suricata, to decide whether to accept or drop them. It is how the lab runs an inline IPS.
nft: The nftables command. -f loads a rules file, -c checks a file without loading it, list shows rules, and -a adds rule handles to the listing.
nftables: The firewall built into the Linux kernel, set up with the nft command. Rules live in chains, and chains live in tables.
nginx: A popular free web server and reverse proxy. Placed in front of an application, it can act as a WAF (with the ModSecurity module), apply rate limits, and serve as a zero trust enforcement point.
NIDS: An IDS that watches network traffic, usually from a passive copy. Kettle & Crane's Suricata sensor on the DMZ is one.
NIPS: An IPS on the network: it sits inline and can drop attack packets.
NIST SP 800-207: The US NIST publication that defines zero trust architecture and splits it into a control plane and a data plane.
nmap: The standard port scanner. It tries each port and reports which ones answer; -Pn skips the ping, -n skips name lookups and -p lists the ports to try.

O

out-of-band management: A separate network that carries only management traffic to each device's management port. Admin access then stays away from production and still works when production is down.
OWASP Core Rule Set: A free, widely used set of WAF rules against common web attacks such as SQL injection. It decides by anomaly scoring.

P

passive: Placed on a copy of the traffic from a tap or SPAN port. A passive sensor can only alert, but if it fails the network carries on.
physical segmentation: Separating networks with separate hardware such as switches and cables, so no configuration mistake can merge them. It costs more and is harder to change.
policy administrator: The zero trust control plane part that carries out the policy engine's decisions, by opening or closing the path and issuing any session token.
policy drop: The line in an nftables chain that says what happens to packets no rule matched. policy drop gives the implicit deny.
policy enforcement point: The zero trust data plane part in front of each resource that lets each request through or blocks it as the policy engine decides. In the lab, nginx on port 8080 plays this role.
policy engine: The zero trust part that says yes or no to each request, based on user, device and its posture, page and context. The lab's pdp.py denies anything it has no rule for.
port forward: A NAT rule that sends traffic arriving on a public port to an inside machine. A contractor's forward of port 22 to the shop exposed its admin login.
port security: A switch protection that limits each port to one or a few known MAC addresses and shuts the port if a new device appears.
posture: A device's health, such as whether its updates are installed. The zero trust policy engine refuses Sam's unpatched laptop because of it.
protected management frames: Signed Wi-Fi management frames, required by WPA3, so forged disconnect frames are ignored. They defeat the classic deauthentication attack.
proxy: A server that makes requests on behalf of others, so it can inspect, filter and log what passes.
PSK: Pre-shared key: WPA2 Personal's shared Wi-Fi password. A captured connection can be used to guess it offline, which SAE prevents.

R

RADIUS: A server that checks each person's login for 802.1X, so WPA3 Enterprise can give every staff member their own account.
rate limiting: Capping how many requests one client may make in a period, such as 10 logins a minute. It slows password guessing, scraping and small floods.
RD Gateway: A Windows role that wraps RDP in TLS on port 443, so RDP never has to be exposed directly.
RDP: Remote Desktop Protocol: how Windows machines are managed remotely, on TCP 3389. It is heavily attacked, so it should be reached only through a VPN or RD Gateway.
reject: A firewall action that throws a packet away and tells the sender with a TCP reset or ICMP "unreachable", so programs fail at once instead of hanging.
remote access VPN: A VPN that joins one person's device, like Alex's home laptop, to the office network through a VPN concentrator.
reverse proxy: A proxy that acts for servers. Customers' requests reach it first, and it passes them to the hidden real server; a WAF is a reverse proxy.
rogue access point: An access point connected to your network without permission, such as a staff member's router or the label printer's Wi-Fi Direct hotspot. It bypasses the firewall's zones.

S

SAE: Simultaneous Authentication of Equals: the WPA3 Personal handshake on a shared password. A captured connection can't be used to guess the password offline.
SASE: Secure access service edge: SSE plus SD-WAN, which delivers security and networking together as one cloud service.
SD-WAN: Software-defined WAN: it joins branches over ordinary internet links and steers traffic over the best path. SASE combines it with SSE.
security service edge: Security checks delivered from the cloud between users, wherever they are, and the apps they use. It is made up of SWG, CASB, ZTNA and FWaaS.
security zone: A part of the network where everything has the same trust level and rules, such as Kettle & Crane's internet, DMZ, office and servers zones. Traffic between zones passes a firewall.
segmentation: Dividing a network into parts that can't talk to each other freely, to limit lateral movement.
shadow IT: Cloud apps staff use without approval. A CASB finds and controls them.
shadowed rule: A rule that never runs because a broader rule above it matches first, like the old router's database deny below an "office to anywhere" allow.
SIEM: The central system that collects alerts and logs, such as Suricata's eve.json and firewall counters.
signature-based detection: Detection that matches patterns of known attacks, such as a URL containing "union" then "select". It is precise, but blind to attacks nobody has written a signature for.
single point of failure: One part whose failure takes everything else down with it, such as a UTM that holds every security function.
site-to-site VPN: A permanent VPN joining two networks gateway to gateway, like the office and the Tacoma warehouse, so the devices behind the gateways need no VPN software.
SPAN port: A switch port that receives a copy of other ports' traffic, so a passive IDS sensor can watch it.
split tunnel: A VPN setup that sends only office traffic through the tunnel, while other browsing leaves directly without the office's protections.
SQL injection: A web attack that slips database commands into user input so the application runs them, such as a search for `1 UNION SELECT password FROM users`. IDS signatures and WAF rules are common defenses that detect or block it.
Squid: A classic free forward proxy, running on port 3128 in the lab. Its acl lines name groups, and its http_access lines allow or deny them, first match wins.
SSH: The encrypted remote login used to manage Linux servers and network devices, on TCP port 22. Its server is sshd.
sshd_config: The SSH server's configuration file. Hardening it, for example with PermitRootLogin no and PasswordAuthentication no, closes doors attackers use.
stateful: Filtering that remembers connections, so a single rule can let every reply to an allowed connection back in. Nearly all firewalls today are stateful.
stateless: Filtering that judges each packet alone with no memory, so replies need their own rules. Router access lists often work this way.
subnet: An address range at layer 3, such as 192.168.20.0/24 for staff. Each VLAN usually gets its own subnet.
Suricata: A free NIDS and NIPS. It runs passively on an interface (-i) to alert, or inline on NFQUEUE (-q 0) to drop.
Suricata rule: One line with an action (alert or drop), a header saying which packets, and options in brackets such as msg (the alert text), content (a pattern to find) and sid. $HOME_NET means the private ranges.
SWG: Secure web gateway: a cloud forward proxy and content filter, so a laptop on hotel Wi-Fi is filtered just as it would be in the office.

T

table: A named nftables container for chains, with a family such as inet, ip or netdev.
threat scope reduction: Letting each request reach only the one resource it needs, so a stolen account opens one door, not the whole building.
TLS: The encryption protocol behind HTTPS, introduced in Cryptography and PKI. TLS VPNs and RD Gateway carry traffic inside it on port 443.
TLS inspection: A proxy or WAF decrypting HTTPS with its own certificate so it can see the page. Without it, a proxy sees only the domain.
TLS VPN: A VPN carried inside TLS, usually on TCP 443, so it works even from hotel Wi-Fi that blocks IPsec. Some are clientless.
transparent proxy: A proxy that the firewall silently redirects web traffic to, so browsers need no proxy setting.
transport mode: An IPsec mode that protects only the payload between two hosts and keeps the original header.
trunk: A link that carries several VLANs at once, such as the cable from the switch to the firewall. Each frame carries an 802.1Q tag.
tunnel mode: An IPsec mode that wraps the whole original packet in a new one. Gateways use it for site-to-site links.
tunneling: Putting a whole packet inside another packet so it can cross a network that couldn't carry it alone. A tunnel by itself hides nothing.

U

UTM: Unified threat management: one appliance with firewall, VPN, IPS, web filter, antivirus and spam filter. It is simple for a small office like Kettle & Crane, but a single point of failure.

V

VLAN: A virtual LAN that splits one switch into separate broadcast domains. Frames never cross VLANs inside the switch, so traffic between VLANs must pass a router or firewall.
VNC: A screen-sharing protocol on TCP 5900. Classic VNC uses short passwords and no encryption, so carry it only inside SSH or a VPN.
VPN: A tunnel plus encryption, integrity and authentication of both ends. Alex uses one to reach the office from home.
VPN concentrator: The device at the internet edge, often part of the firewall, that accepts many remote access VPN connections.

W

web application firewall: A reverse proxy that understands HTTP and checks each request for web attacks such as SQL injection. Kettle & Crane's WAF is nginx with ModSecurity and the OWASP CRS.
WIDS: A wireless monitoring system that only alerts, without the preventive actions of a WIPS.
WIPS: Wireless intrusion prevention system: radio sensors compare every AP they hear with the list of authorized APs and alert on evil twins, changed security, rogues and deauth floods. Prevention can mean shutting a rogue AP's switch port.
WireGuard: A small, modern VPN built into the Linux kernel and available on other systems. It runs over UDP (often port 51820) and identifies each end by a public key, much like SSH keys.
WPA3 Enterprise: WPA3 with a personal login for each user through 802.1X and RADIUS, so a leaver's account is simply disabled. Kettle & Crane uses it for staff.
WPA3 Personal: WPA3 with one shared password protected by SAE; everyone's password must change when someone leaves. Kettle & Crane uses it for guests.

X

X-Forwarded-For: An HTTP header a reverse proxy can add to pass the real client address to the app, which otherwise sees every request as coming from 127.0.0.1.

Z

zero trust architecture: A network design that verifies every request by user, device and context, never trusting location. It is split into a control plane that decides and a data plane that enforces.
zone matrix: A table of which zone may start connections to which, on which ports; empty cells mean no. It serves as the firewall's specification and test list.
ZTNA: Zero trust network access: the part of SSE that acts as the policy enforcement point for private apps. Each request reaches one named app after a policy check, instead of a VPN into the whole network.