Glossary

169 terms from Security Testing and Awareness Training, in plain words, each with the chapter that teaches it.

Search the glossary

A

Acceptable use policy (AUP): The document that says what staff may and may not do with company systems. New staff such as Riley read and sign it during onboarding training.
Account provisioning: Setting up a new person's accounts and access. Onboarding training is tied to it: the HR checklist puts "security training complete" next to "laptop issued".
Activity metrics: Numbers that show training happened, such as the completion rate or the average quiz score. They don't show whether behavior changed.
AI-written phishing: Phishing emails written by AI (artificial intelligence) tools. They are fluent and free of errors, so the old rule "look for bad spelling" no longer works, and staff should judge the request instead.
AICPA (American Institute of Certified Public Accountants): The US accounting body that defines SOC 2 audit reports.
Annex A: The part of ISO/IEC 27001 that lists 93 controls in four themes: organizational, people, physical and technological. Alex maps Kettle & Crane's controls to it for the grocery chain.
Awareness, training and education: Three depths of learning from NIST SP 800-50. Awareness points attention at a risk (a poster), training builds a skill people can use (practice spotting fake invoices), and education builds deep knowledge over a long time (a college course).

B

Baiting: Leaving tempting devices where staff will find them, such as a USB drive labeled "Salaries 2026", so that curiosity makes someone plug one in.
Baseline: A starting point that later results are compared with, such as a first phishing click rate measured at the start of an awareness program. In training, it also means the shared set of security rules every new person learns during onboarding, before they get access.
Behavioral testing: Testing what people actually do compared with what policy and training say they should do, for example a phishing simulation or sending a visitor without a badge into the warehouse.
Blocklist: A list of passwords that are never allowed because they are common, already leaked or easy to link to the company. Alex's passcheck.py rejects "password1234567" because it is on one.
Business email compromise (BEC): Fraud that uses a taken-over business email account, or a look-alike one, to trick staff into sending money or data. It often has no link or malware, like the fake Andes Beans invoice with new bank details sent to Jo.
BYOD (bring your own device): Staff use their own phones, tablets or laptops for work. A signed BYOD policy and MDM enrollment keep work data in a separate area that the company can manage and wipe.

C

Callback phishing: An email claiming you were charged, such as a "$499 renewal", with a phone number to call. The number reaches the attacker, who talks the victim into installing remote-control software.
CEO fraud: An email that seems to come from the boss (CEO, chief executive officer) and asks for an urgent, secret payment or gift cards. It is a form of BEC.
Certification: Formal confirmation by an accredited auditor that an organization meets a standard's requirements. You can be certified against ISO/IEC 27001 but not against the guidance in 27002.
CIS Controls (Center for Internet Security): A free set of 18 prioritized security controls from the nonprofit Center for Internet Security, broken into 153 Safeguards and three Implementation Groups (version 8.1). Control 14 covers security awareness and skills training, and because CIS is not a government body, the Controls count as an international standard.
CISA (Cybersecurity and Infrastructure Security Agency): The US government's cyber defense agency. Alex follows its alerts to keep training up to date.
Clean desk and screen walk: A behavioral test in which a reviewer checks after hours for passwords on sticky notes, unlocked screens and printed customer data.
Click rate: The share of simulated phishing emails whose link was clicked: people who clicked ÷ emails sent. Lower is better. Kettle & Crane's was 23% in October.
CMMC (Cybersecurity Maturity Model Certification): A US security certification for defense contractors, required in contracts since November 10, 2025. It is region-specific, and also industry-based because it covers one sector.
COBO (corporate-owned, business only): A mobile deployment model in which the company owns the device and locks it down fully for work only, with no personal use.
Completion rate: Courses finished ÷ courses assigned. Alex's LMS report showed 6 of 8, or 75%. It is an activity metric: it shows people finished the course, not that their behavior changed.
CompTIA Security+ (SY0-801): An entry-level cybersecurity certification exam from CompTIA, Inc. that tests core security knowledge. Objective 5.5 covers audit and assessment, including frameworks, standards and testing, and objective 5.6 covers security awareness.
COPE (corporate-owned, personally enabled): A mobile deployment model in which the company owns the device but allows personal use. Because it owns the device, the company can wipe all of it.
Corrective control: A type of control that acts after a problem to restore the right state. Corrective training is one, because it fixes a person's habit.
Corrective training: Training given to a person or a small group after a mistake or policy violation to fix the behavior, such as Priya's short module after clicking a simulated phish. It teaches; it is not punishment.
Credential: Anything that proves who you are to a system: a password, a PIN, an MFA code, a passkey, a badge, or a key or token a program uses.
Credential management: How people create, store, use and protect their credentials. Good habits include long passphrases, a unique password for every site, a password manager and MFA.
Credential rate: The share of simulated phishing emails in which someone typed a password: people who typed a password ÷ emails sent. It should move toward zero.
Credential stuffing: After one site is breached, attackers try the same email and password on many other sites. This happened with Sam's reused forum password; a unique password for every site stops it.
CSA CCM (Cloud Security Alliance Cloud Controls Matrix): An industry-based control framework for cloud providers and their customers.
CSA STAR registry: A public registry where cloud providers publish their answers to the CSA Cloud Controls Matrix.
Cyber Essentials: A UK government scheme with five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Many UK government suppliers must have it.
CYOD (choose your own device): A mobile deployment model in which the company owns the device and the employee picks it from an approved list.

D

Data loss prevention (DLP): Tools that spot sensitive data leaving the company, for example by email. Their alerts can feed a personnel behavior risk score.
Deepfake: Fake audio or video made with AI that copies a real person's voice or face, like the voice message that sounded like Morgan asking Jo to wire $9,800. A familiar voice or face is not proof of identity.
Default policy (policy accept / policy drop): In an nftables chain, the action taken on traffic that no rule matches. Kettle & Crane's shop server was left on `policy accept`, which let SSH, Telnet and database traffic through until Alex changed it to `policy drop;`.
Delivery mechanism: The way training reaches people. The exam names four: an LMS, a self-service portal, one-to-one and one-to-many.
Disciplinary action: Punishment under HR's written sanctions policy. It is the last step, used only if coaching fails. It is different from corrective training, which teaches, and is never the answer to a first simulation failure.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): An email sender check that helps filters catch mail from domains that are faked. It cannot catch BEC sent from a supplier's real, compromised mailbox.

E

Emerging security topics: New threats and risky new ways of working that training must add as they appear, such as AI-written phishing, deepfakes, quishing, MFA fatigue, callback phishing and the safe use of AI tools.
Essential Eight: The Australian Signals Directorate's list of eight mitigation strategies, assessed against maturity levels. It is a region-specific standard.

F

FBI (Federal Bureau of Investigation): The US federal law enforcement agency. It warns about scams such as deepfake voice messages, and its IC3 center records BEC losses.
FCC (Federal Communications Commission): The US agency that warns travelers about juice jacking at public USB charging ports.
FedRAMP (Federal Risk and Authorization Management Program): A US program for cloud services sold to federal agencies. It is region-specific.
Finding: A recorded mismatch between what a control should do and what it actually did. Each FAIL line in Alex's port test is a finding.
Framework: A structured set of good practices that tells an organization which security areas to cover and usually leaves the details to it, for example the NIST Cybersecurity Framework.
Functional testing: Checking that a control does what it should by giving it real input and comparing the result with the expected one, like Alex's port test or restoring last night's backup.

G

GDPR (General Data Protection Regulation): The EU privacy law for anyone handling personal data of people in the EU. It applies even to a US company that sells to EU customers.
Group Policy: A Windows management feature. Its Removable Storage Access settings can deny all access to USB drives and other removable storage.

H

Hardware security key: A small physical device you plug in or tap to sign in. It is a phishing-resistant MFA factor.
HIPAA Security Rule: A US law that protects electronic health information held by health plans, health care providers and their business associates. It is both a regulation and an industry rule, and it requires training.
HR (human resources): The department that handles staff matters. It must be told about behavioral tests, it keeps onboarding checklists, and it applies the sanctions policy only after coaching fails.
HTTPS: Secure, encrypted web traffic. The shop server should accept only HTTPS from the internet, on port 443.
Hybrid work: Splitting the working week between the office and a remote place. Jo and Sam work from home two days a week.

I

IC3 (Internet Crime Complaint Center): The FBI center where cybercrime such as BEC is reported. It recorded about $3.05 billion in BEC losses in 2025.
IEC (International Electrotechnical Commission): An international standards body that publishes security standards together with ISO, such as ISO/IEC 27001.
Impersonation: Pretending to be someone the victim trusts, such as the boss, IT support or a supplier, like the "Chris from IT" call to Priya.
Incident response: The steps taken when a real attack happens, such as resetting a password and checking the account. After a real phish, it comes before any training.
Industry-based standard: A standard written by or for one industry and followed because of the type of business, for example PCI DSS for any company that takes cards.
Initial/onboarding training: Security training a person gets on joining, or on taking a new role, before or as they get access. Riley gets it before the account is turned on.
International standard: A standard written by a global body such as ISO for organizations in any country and any industry, for example ISO/IEC 27001.
Intranet: A company's internal website. Alex's self-service security portal lives there.
ISMS (information security management system): The policies, processes and people that manage an organization's security risk. ISO/IEC 27001 sets its requirements.
ISO (International Organization for Standardization): An international standards body that publishes security standards, many of them jointly with IEC.
ISO 22301: An international standard that sets requirements for business continuity.
ISO 31000: An international standard that gives guidance on risk management.
ISO/IEC 27001: The international standard that sets requirements for an ISMS. An organization can be certified against it, and its Annex A control 6.3 covers awareness training.
ISO/IEC 27002: Guidance on how to put the 93 controls of ISO/IEC 27001 in place: the "how to" companion. You cannot be certified against it.
ISO/IEC 27017: An international standard that adds security controls for cloud services. It extends 27002.
ISO/IEC 27018: An international standard for protecting personal data (PII) held in public clouds. It extends 27002.
ISO/IEC 27701: An international standard for a privacy information management system. Since the 2025 edition it stands on its own and no longer needs 27001 first.

J

Jailbroken or rooted: Describes a phone that has had the maker's security controls removed. A BYOD policy does not allow such phones.
Juice jacking: An attack through a tampered public USB charging port, for example in an airport, that tries to read data from a phone or install malware while it charges.

K

Keystroke-injecting device: A device that looks like a flash drive or cable but acts as a keyboard, "typing" commands very fast when plugged in. Antivirus may never see it, because it isn't a file.

L

Learning management system (LMS): Software that stores courses, assigns them by rule, delivers them online, sends reminders, and records who finished them and how they scored. Its completion report is the evidence auditors want.
Look-alike domain: A web or email address that is slightly different from the real one, such as `kettlandcrane.com` or `andesbeans-pay.example`. BEC attackers use these to fool readers.

M

Malicious cable: A charging cable that looks normal but hides a chip that injects keystrokes or gives the attacker a wireless link.
Managerial report: A summary of the awareness program's results, shaped for the person reading it. Morgan gets key numbers, trends, targets and decisions with no staff names; the warehouse lead gets the team's details.
MDM (mobile device management): The system that enrolls phones and enforces security settings on them. On a BYOD phone, enrollment creates a separate, managed work area.
Median: The middle value after sorting, or the average of the two middle values when the count is even. October's median report time was (10 + 14) ÷ 2 = 12 minutes. Unlike an average, one very late reporter doesn't pull it up.
Metric: A number, measured the same way each time, that shows how well something is working, such as the click rate or the completion rate.
MFA (multifactor authentication): Requiring a second proof of identity, such as an app code, on top of a password. MFA blocked the sign-ins on Sam's account that used the stolen password.
MFA fatigue: An attacker who already has a password sends sign-in prompts again and again, hoping the victim taps "Approve" to make them stop. Deny the prompt, report it and reset the password.
Microlearning: Short lessons spread over time, such as Kettle & Crane's five-minute monthly modules.
Monitoring and reporting: Monitoring means collecting results over time. Reporting means turning those results into something a decision-maker can act on.

N

NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection): Mandatory standards for companies that run the North American power grid. CIP-004 requires security awareness to be reinforced at least once each calendar quarter for staff with access to grid systems.
nftables: The Linux firewall tool whose rules controlled the lab shop server in Alex's port test.
NIS2 Directive: An EU directive covering essential and important entities in EU member states. It is region-specific.
NIST (National Institute of Standards and Technology): A US government agency that publishes security guidance, such as Special Publications (SPs) like SP 800-53 and SP 800-50, and the Cybersecurity Framework. Because its documents are US government publications, they count as region-specific unless voluntary worldwide use is stressed.
NIST Cybersecurity Framework (CSF): A free, voluntary NIST framework for organizing security. Version 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is used worldwide, but as a US government publication it counts as region-specific by default; Kettle & Crane uses it to organize its security plan.
NIST SP 800-46 Revision 2: NIST's telework guide. It starts from the idea that home and public networks are hostile.
NIST SP 800-53: NIST's catalog of security controls for US federal agencies and their systems. It is region-specific.
NIST SP 800-63B-4: NIST's authentication guidelines, finalized in August 2025. Passwords must be at least 15 characters (8 if used only with MFA), with no forced composition rules or periodic changes, blocklist checks, and password managers allowed.

O

One-to-many: One trainer or message reaches a whole group at once, such as Alex's ten-minute talk at shift change about a live scam. It is fast and efficient but not tailored to each person.
One-to-one: One trainer works with one person, as in Alex's private session with Sam after three failed simulations. It is the most personal method but does not scale.
Ongoing training: Training everyone repeats at regular intervals: a yearly refresher plus small, frequent pieces such as monthly modules and simulations, so knowledge doesn't fade.
Operational security (OPSEC): Protecting small pieces of information that look harmless alone but could help an attacker together, such as Morgan's travel post and out-of-office reply. It controls what goes out.
Out-of-band verification: Confirming a request through a different channel from the one it came by. For example, Jo calls Andes Beans on the number in the supplier file and never uses contact details from the email.
Out-of-office reply: An automatic email reply sent while someone is away. For OPSEC, keep it short: no trip details, dates or name of the person who handles payments.
Outcome metrics: Numbers that show behavior changed, such as the click rate, report rate, time to report and the number of incidents caused by human error.

P

Passkey: A phishing-resistant way to sign in that is stored on your device and used instead of typing a password. Staff should prefer it where a site offers it.
Passphrase: A long password made of several random words, such as `harbor velvet kettle orbit`. It is easy to remember and hard to guess.
Password manager: An app that creates, stores and fills strong, unique passwords, locked by one master passphrase. It refuses to fill a password on a look-alike site.
Payroll diversion: A BEC trick in which a message "from" an employee such as Sam asks to change their direct deposit to a new account.
PCI DSS (Payment Card Industry Data Security Standard): The card industry's security standard for anyone who stores, processes or sends cardholder data. Requirement 12.6.3 makes Kettle & Crane train staff when they are hired and at least every 12 months.
Penetration testing: Testing the whole defense the way an attacker would, to see whether someone can get in and how far. Its aim is the break-in, not measuring habits.
Personnel behavior risk scoring: Giving each person a score built from their security behavior. For example, Drew's click (+10), typed password (+20) and report (−5) add up to 25. The score decides who gets support first; it is not a punishment.
Phishing: A fake email, often with a link or attachment, sent to many people to steal passwords, money or access.
Phishing simulation: A harmless fake phishing email sent to staff to record who opens it, clicks, types a password and, most important, reports it.
Piggybacking: Like tailgating, except the insider knowingly holds the secure door open for the other person.
PII (personally identifiable information): Information that identifies a person, such as a name or address. ISO/IEC 27018 protects it in public clouds.
PIN (personal identification number): A short secret number used as a credential.
Policy acknowledgment: A signed record that a person has read and accepted a policy, such as the AUP. It is kept as evidence for auditors.
Port: A numbered network entry point on a server: 443 for HTTPS, 22 for SSH, 23 for Telnet and 3306 for the database. Alex's test checks which ports are open or blocked.
Pressure tactics: Tricks that make people act without thinking: urgency, authority, fear, helpfulness, curiosity, secrecy, scarcity, social proof, familiarity and intimidation. When you spot one, pause, verify and report.
Pretexting: A made-up story that gives the attacker a reason to ask, such as "I'm the new auditor" or "I'm here to service the copier".
Privacy screen filter: A screen cover that makes a laptop hard to read from the side. It helps against shoulder surfing.
Push versus pull: An LMS pushes training by assigning courses with due dates. A self-service portal is pull: people come to it when they need help.
python3: The command that runs the Python 3 interpreter, used to run Python scripts from the command line, for example `python3 functest.py 192.0.2.10` to test which ports a server's firewall allows, or `python3 metrics.py phish-results.csv` to calculate phishing simulation metrics.

Q

QR code (Quick Response code): A square barcode that a phone camera turns into a web link.
Quishing: Phishing through a QR code, so the link hides inside an image that many email filters cannot read.

R

Region-specific standard: A standard or law that applies in one country or region and is often written by a government, such as GDPR or Cyber Essentials.
Regulation: A rule made by a government body with legal force. Breaking it can bring fines or the loss of a license.
Remote work: Working away from the office, such as at home, in a café or while traveling. Teleworking is the same idea in government and policy language. Training covers the device, the connection and the place.
Removable media: Storage that plugs in and out of a computer, such as USB flash drives, external disks, memory cards and phones used as storage.
Repeat clickers: People who clicked in two or more phishing simulations. The number should go down.
Reply-To header: An email header that sets where replies go. In the fake Andes Beans email it pointed to a free email account, so Jo's reply would have reached the attacker.
Report rate: People who reported a simulated phish ÷ emails sent. Higher is better, and a rising report rate is the strongest sign of a healthy culture. Kettle & Crane's rose from 23% to 62%.
Risk band: A range that groups risk scores. At Kettle & Crane, 0–14 is low, 15–29 medium and 30 or more high. Executives see only the count in each band.
Role-based training: The most common kind of targeted training, chosen by job: invoice fraud for finance, privileged accounts for IT administrators, whaling for executives.
Rules of engagement: The written, approved limits for a penetration test. Behavioral tests likewise need written approval from management first.

S

Security awareness program: The planned set of activities that teaches everyone to spot and avoid security risks, and what to do when something goes wrong. It treats people as a security control.
Selective wipe: Erasing only the work apps and data from a BYOD phone, for example if Priya's phone is lost. Personal photos and data stay.
Self-assessment questionnaire: The yearly form Kettle & Crane completes for its payment processor to show PCI DSS compliance.
Self-service password reset: A portal task that lets staff reset a forgotten password themselves. It needs a strong identity check such as an MFA prompt, not a security question that is easy to guess.
Self-service portal: A website, often on the intranet, where staff find guides, policies, tools and a "report it" button whenever they need them. Nobody assigns it.
Shadowing: A one-to-one method in which the learner watches an experienced person do the task.
Shoulder surfing: Watching someone's screen, keyboard or papers to read what they are working on. When it happens, stop: lock the screen and carry on somewhere private.
Situational awareness: Paying attention to what is around you, physically and digitally, so you notice what doesn't fit, as Drew did with the fake copier technician. Then you respond safely: ask, verify, report.
Smishing: Phishing by text message. SMS means Short Message Service, ordinary phone texts.
SOC 2 (System and Organization Controls 2): An audit report defined by the AICPA, in which an independent auditor checks a service company's controls against the Trust Services Criteria.
SOC 2 Type I: A SOC 2 report that checks the design of the controls at one point in time.
SOC 2 Type II: A SOC 2 report that checks the controls operated effectively over a period, often 6 to 12 months.
Social engineering: Tricking people into giving away information, granting access or sending money. It attacks a person's judgment instead of a computer.
Spear phishing: Phishing aimed at one named person or small group, using details about them.
SSH (Secure Shell): The encrypted remote admin login. On the shop server it uses port 22 and should be allowed only from the admin network.
Standard: A document of specific requirements that an auditor can check line by line as "met" or "not met", such as ISO/IEC 27001.

T

Tailgating: Following someone through a secure door without their knowledge. A tailgating test checks whether staff let a stranger follow them through a badge-controlled door.
Targeted training: Training planned for one group because of its role or risks, before any mistake, such as the invoice fraud session for Jo, Sam and Morgan.
Teachable moment: A short page explaining the red flags, shown right after someone clicks a simulated phish, while the moment is fresh.
Telnet: An old, unencrypted remote login service on port 23. It should never be allowed on the shop server.
Test of design: An audit check of whether a control, as written, would meet its requirement.
Test of operating effectiveness: An audit check of whether a control really worked, every time, during the audit period. Functional tests give evidence for it.
Time to report: Minutes from sending a simulated phish to the reports, usually measured as the median or the first report. Shorter means real attacks are caught sooner.
Trust Services Criteria: The five areas a SOC 2 report can cover: security (always included), availability, processing integrity, confidentiality and privacy.
Two-person approval: A process control in which large payments and every bank detail change need a second person's approval. It is often paired with a waiting period before a new account is used.
Typosquatting: Registering a misspelled or look-alike domain, such as `kettlandcrane.com`, to catch mistyped addresses or fool readers.

U

USB (Universal Serial Bus): The common plug-in connection used for flash drives, cables and charging ports.
USB data blocker: A small adapter that passes power but not data, so a phone can charge safely from a public USB port.
USB drop test: A behavioral test in which harmless, marked USB drives are left in the parking lot to see who plugs one in.

V

Vendor email compromise: BEC in which the attacker has broken into a supplier's real mailbox and sends fake bank-change requests from it.
Vishing: Phishing by phone call or voice message, like the fake IT caller who asked Priya for an MFA code. In a vishing test, a tester phones staff pretending to be the help desk.
VPN (virtual private network): An encrypted tunnel from a remote device to the company network. It protects the connection only, not the screen or an unattended laptop.

W

Watering hole: An attack in which the attacker infects a website the target group already visits, such as a trade forum, and waits for them to arrive.
Whaling: Phishing aimed at senior leaders such as Morgan. It is a form of spear phishing.
Work profile: The separate, managed work area created when a personal phone is enrolled for BYOD. Android calls it a work profile and Apple calls it User Enrollment. The company sees and wipes only this part.
WPA2/WPA3 (Wi-Fi Protected Access): The Wi-Fi encryption settings remote workers should use on their home network, together with a strong passphrase.