Compliance, Privacy and Penetration Testing

Glossary

209 terms from Compliance, Privacy and Penetration Testing, in plain words, each with the chapter that teaches it.

Search the glossary

#

-p: An Nmap option that lists the ports to check. In the lab scan, -p 22,80,443,8443 told Nmap to test only those four ports on the stand-in shop server.
-sV: An Nmap option that connects to each open port and works out which service and version runs there. In the lab it showed a Python web server and its exact version, which a tester can use to look up known flaws.

A

Actions on objectives: The seventh and last step of the Cyber Kill Chain. The attacker does what they came for, such as stealing data.
Active reconnaissance: Gathering information by sending traffic straight to the target's systems or contacting its people, for example with ping sweeps, port scans or phone calls. It gives exact, current information, but the target can see it in its logs and packet captures.
Adversary: In the Diamond Model, the person or group carrying out the attack: the 'who' corner of the diamond.
AICPA: The US professional body for certified public accountants. Its attestation standards govern examinations such as SOC 2 reports.
Assertion: A formal claim, usually from management, that a control is in place or a statement is true, such as 'we disable leavers' accounts within one business day'. It is the starting point the auditor must test, so on its own it is the weakest evidence.
Assessment: A review of how well controls work, usually to find weaknesses and improve them. An external assessment, such as Dana's PCI DSS assessment, ends in findings and recommendations rather than a formal opinion.
Assurance: The confidence an engagement's result gives to the people who rely on it. More independence and more testing give more assurance, so a self-assessment gives the least.
ASV: Approved Scanning Vendor: a company approved to run the external vulnerability scans that PCI DSS requires at least every three months.
Attestation: A signed statement affirming compliance. Management can make one, as with the PCI DSS Attestation of Compliance, and so can an independent practitioner.
Attestation of Compliance: The signed statement a company gives in a PCI DSS assessment to declare that it meets the standard. Signing one does not turn the work into an examination.
Audit: A formal check of whether a company does what a rule, standard or policy says it must do. The auditor bases the conclusion on evidence, not on what they are told.
Audit charter: The long-lived formal document, approved by the board or audit committee, that creates the internal audit function and sets its purpose, authority, independence and standards. Morgan's one-page charter lets Alex review any system and report straight to the board.
Audit committee: A small group of board members, who should be independent of management, that oversees a company's audits. It approves the charter and audit plan, receives internal audit's reports and oversees the outside auditors. At Kettle & Crane the two investors play this role.
Audit plan: The schedule of all audits planned for a year. Internal audit builds it from a risk assessment and the audit committee approves it.
Authorization letter: A letter that physical penetration testers carry, signed by someone with authority over the building, with a number to call at any hour. It shows staff or police that the test is approved.

B

Badge cloning: Copying the radio signal of an access badge, for example with a reader hidden in a bag, so the copy can open the same doors.
Banner grabbing: Connecting to a network service and reading what it reports about its software and version. It is a form of active reconnaissance.
Benchmarking: Comparing a company's practices or results with those of peers, industry averages or best practice, using metrics. Kettle & Crane found it takes 21 days to patch critical flaws, while its peer group averages 9.
Blue team: The defenders: the security staff who watch alerts and respond to incidents. Defensive testing measures how well they detect, respond and recover.
Board of directors: The group that oversees a company's managers on the owners' behalf. Kettle & Crane's board is Morgan and two investors.
Bug bounty program: A program that invites outside researchers to find flaws and pays them for valid reports. Unlike a pen test, it runs all the time under published rules instead of in one agreed window.

C

CAIQ: Consensus Assessments Initiative Questionnaire: a standard vendor security questionnaire from the Cloud Security Alliance, so suppliers don't have to answer a different list for every customer.
CAN-SPAM Act: A US law on marketing email. It uses an opt-out model: every email needs a working unsubscribe link, and requests must be honored within 10 business days.
Capability: In the Diamond Model, the tools and methods an attacker uses, such as malware or the fake payment link in the kettle-and-crane-billing.com emails.
CCPA: California Consumer Privacy Act: a privacy law that protects California residents and applies to businesses that meet its size or data thresholds. It gives rights such as the right to delete, to correct and to know, and requires a 'Do Not Sell or Share' opt-out link.
Certificate transparency logs: Public logs of every TLS certificate issued. Reading them is passive reconnaissance, and they often reveal server names. That is how Dana's tester found staging.kettleandcrane.com.
Certification body: An accredited organization that audits a company against a standard such as ISO/IEC 27001 and issues the certificate.
Chain of custody: A record of who handled a piece of evidence, when and why, which proves it was not altered. Alex's log of the subpoenaed shipping export is the start of one.
Chief audit executive: The head of internal audit. They report to the board or audit committee, not to the managers being audited, so bad findings can't be hidden.
CIS Benchmarks: Secure configuration guides for systems, published by the Center for Internet Security. They are baselines to configure against, not the benchmarking engagement type.
Class action: One lawsuit brought on behalf of a large group of people who suffered the same harm.
Cleanup: The pen test phase in which testers remove every tool, account and file they added, so they leave nothing an attacker could use.
Command and control (C2): The sixth Cyber Kill Chain step, in which the malware connects back to the attacker for orders. Kettle & Crane would miss it because nothing watches its outbound traffic.
Complementary user entity controls: Controls that a SOC 2 report says the customer must run itself, such as turning on multifactor authentication. If Kettle & Crane skips them, the provider's clean report doesn't protect it.
Compliance: Following the rules that apply to you: laws and regulations, contracts and standards you have agreed to, such as PCI DSS. As an engagement type, it is the internal check that those rules are followed.
Compliance function: The second-line team, led by a compliance officer, that lists the rules a company must follow and keeps checking that they are met. Priya's monthly check of privacy-request deadlines is an example.
Consent: A person's active agreement to a use of their data. Under the GDPR a pre-ticked box, silence or doing nothing is not consent.
Contractual consequences: Harm imposed by the other party to a broken contract under its terms, such as penalty fees, a required audit or termination. The bank's PCI DSS fee and Hearth walking away are contractual.
Corroborate: To confirm one piece of evidence, such as an interview answer, with other evidence like documents or tests.
Court order: A legal order from a judge to do or stop doing something, such as handing over records.
Coverage map: A list of the ATT&CK techniques that matter to a company, each marked as covered, partly covered or not covered by controls and logs. The gaps become findings.
CPA: Certified public accountant. Independent CPA firms run SOC 2 examinations.
CSV: Comma-separated values: a common, machine-readable file format, used for example to give people their data under the right to data portability.
Current profile and target profile: In NIST Cybersecurity Framework 2.0, the current profile describes where a company is now and the target profile describes where it wants to be. The difference between them becomes the gap analysis plan.
Custodians: In a legal hold, anyone who holds information relevant to the case and receives a hold notice. This is not the same as the data custodian role.
CVSS: Common Vulnerability Scoring System: a scale often used to rate the severity of pen test findings, adjusted for the company's own risk.
Cyber Kill Chain: Lockheed Martin's 2011 model of an intrusion as seven ordered steps, from reconnaissance to actions on objectives. The defender wins by breaking any link, and the earlier the better.

D

Data controller: The organization that decides why and how personal data is processed, and that must answer data subjects' requests. Kettle & Crane is the controller for its newsletter. The CCPA calls this role a 'business'.
Data correction: A person's right to have inaccurate or incomplete personal data fixed in every system that holds it. The data is changed, not deleted.
Data owner: The senior person accountable for a data set, who decides who may access it and how it is classified. Sam owns the wholesale customer data.
Data processor: An organization that processes personal data on a controller's behalf and only on its documented instructions, such as the email service that sends Kettle & Crane's newsletter. The CCPA calls this role a 'service provider'.
Data protection authority: A European government regulator that enforces the GDPR and can investigate companies.
Data retention requirements: Rules on how long data must be kept (a minimum, such as for tax records) and how long it may be kept (a maximum, such as the GDPR's 'no longer than needed').
Data subject: The person that personal data describes, such as the customer in Lyon who asked Kettle & Crane to delete their account.
Defensive testing: Testing from the defender's side: it checks whether the blue team detects, responds to and recovers from attacks, for example whether an alert fired and how fast.
Delivery: The third Cyber Kill Chain step: sending the attack tool to the victim, for example by email. Kettle & Crane's email filter blocks some attachments at this step.
Diamond Model of Intrusion Analysis: A 2013 model that describes one intrusion event by four linked features: adversary, capability, infrastructure and victim. Analysts pivot from a known corner to the others.
DNS: Domain Name System: public records that list a domain's web, mail and other server names. Looking them up through a third-party service is passive recon, while querying the company's own DNS server is active.

E

E-discovery: Identifying, collecting and producing electronically stored information for a legal case, such as searching all email and handing the results to the other side.
Economic sanctions: Rules that forbid doing business with certain countries, groups or people. In the US, OFAC publishes the list, and selling to someone on it breaks the law even by accident.
Engagement: One piece of audit or assessment work, with a start, a scope and a report. The exam sorts engagements by who does the checking: internal or external.
Engagement letter: A document that sets the scope of one audit or assessment: which systems, locations, time period and standard are included, and what is excluded. For example, Dana's engagement letter for Kettle & Crane covered the payment pages and office network for the last 12 months and excluded the roastery.
Evidence: The information an auditor uses to reach a conclusion. It should be relevant, reliable and enough. Tested evidence outweighs claims.
Examination: A formal external engagement in which an independent practitioner tests a subject and gives a written opinion with reasonable assurance, as in a SOC 2 report. Regulators' formal visits are also called examinations.
Exception: An item tested by an auditor where the control failed, such as leaver L21's account staying active for 12 days. SOC 2 reports list exceptions too.
Executive summary: The plain-language opening section of a pen test report, written for managers.
Exfiltration: An ATT&CK tactic: sending stolen data out of the victim's network.
Exploitation: Using a weakness to make attack code run or to get in. It is a Cyber Kill Chain step and the pen test phase that gains initial access.
External engagement: Audit or assessment work done by independent outsiders: examinations, assessments, regulatory audits and independent third-party audits. It costs more but earns more trust.

F

Financial consequences: Money lost because of non-compliance: direct costs such as fines and bank fees, and indirect costs such as investigators, lawyers, notification letters and higher premiums.
Finding: A problem an auditor, assessor or tester reports, with what is wrong and what to fix. One example is 'the leaver process depends on one email'.
Framework: A structured way to describe and organize knowledge, such as MITRE ATT&CK or the NIST Cybersecurity Framework.
Frequency: How often an audit, assessment or test happens. It is set by rules (such as PCI DSS's quarterly scans and yearly pen tests), risk, major changes and events such as incidents.
FTC: Federal Trade Commission: a US regulator that often settles privacy cases with orders lasting up to 20 years and regular outside assessments.

G

Gap analysis: Comparing the current state with a target, such as the PCI DSS requirements, marking each item met, partly met or not met, and planning fixes for the gaps.
GDPR: General Data Protection Regulation: the EU privacy law that protects people in the EU and applies to any company offering them goods, wherever it is based. It applies to Kettle & Crane's European customers and gives rights such as erasure, restriction and objection.
Governing body: The group above the three lines that oversees the company, usually the board of directors with its audit committee.

H

Hash: A short fixed-length fingerprint computed from a file. Any change to the file changes the hash, so it proves integrity. Alex hashed the shipping export sent under the subpoena.
HIPAA: Health Insurance Portability and Accountability Act: a US law for health organizations. Audits of health organizations under it by the Office for Civil Rights are an example of a regulatory engagement.
HTTP: Hypertext Transfer Protocol: the language of the web. Its GET request asks for a page and its POST request sends data. Nmap's GET and POST /sdk requests showed up in the lab server's log.
HTTP status codes: The number a web server returns for each request. In the lab log: 200 (OK, page found), 404 (Not Found) and 501 (Not Implemented, method not supported).

I

ICMP: Internet Control Message Protocol: the protocol networks use to send error and control messages. An ICMP 'unreachable' reply, or no reply at all, makes Nmap report a port as filtered.
Indemnification: A contract promise to cover the other party's losses. After a failure, it can make a company pay for its partner's harm.
Independence: Having no stake in the result being checked. An auditor who designed the controls, or who earns money from fixing them, can't audit them, which is why Alex's own review wouldn't satisfy Hearth.
Independent third-party audit: An audit by an outside organization that is neither the company nor its customer and has no stake in the result, such as ISO/IEC 27001 certification. Many customers can rely on one report.
Infrastructure: In the Diamond Model, what the attacker uses to deliver or control an attack, such as IP addresses, domains like kettle-and-crane-billing.com, and email accounts.
Initial access: Getting into the target in the first place. It is an ATT&CK tactic and the result of the exploitation phase of a pen test.
Inspection: An evidence method in which the auditor reads documents and settings directly. Evidence the auditor sees firsthand is stronger than what the company says.
Installation: The fifth Cyber Kill Chain step: the malware installs itself so it stays on the machine. Endpoint protection may stop it here.
Institute of Internal Auditors: The professional body whose Global Internal Audit Standards (in force since January 2025) require an audit charter, and which describes the Three Lines Model.
Integrated testing: Attackers and defenders work together openly in one exercise: the testers run a technique, both sides check whether it was seen, and the defenders tune their tools. It is often called purple teaming.
Internal engagement: Audit or assessment work run by the company's own people: compliance checks, audit committee oversight and self-assessments. It is cheaper and can run often, but outsiders trust it less.
Interview: A conversation in which the auditor asks the people who run a process how it really works, ideally with a walkthrough. It finds gaps documents miss, but it needs corroboration.
IP address: An Internet Protocol address that identifies a device on a network, such as 192.0.2.20 in the lab. It counts as personal data, and in the Diamond Model it is part of the attacker's infrastructure.
ip netns exec: A Linux command that runs another command inside a named network space. The lab uses it to run Nmap as the 'tester' and tcpdump as the 'shop'.
IRS: Internal Revenue Service: the US tax agency. It says to keep most tax records at least 3 years and employment tax records at least 4, which sets retention minimums.
ISO/IEC 27001: An information security management standard published jointly by the ISO and the IEC. Certification bodies audit against it in two stages, and the certificate lasts three years, with a smaller surveillance audit each year.
IT: Information technology: the computer systems and the team that runs them. At Kettle & Crane, Alex looks after it.

J

Judgmental sampling: Sampling in which the auditor chooses items on purpose, such as late-Friday changes. It finds problems fast but doesn't represent the whole population.

K

Kali Linux: A Linux distribution built for security testing that bundles hundreds of tools, including Nmap.
Known environment: A pen test in which testers get full information: diagrams, IP lists, settings, code and accounts. It is the most thorough choice in limited time, but it doesn't show what an outsider could find.

L

Lateral movement: Moving from the first compromised machine to others on the network. It is an ATT&CK tactic and part of pen test post-exploitation.
Legal consequences: Harm that comes from the law and the courts: lawsuits, government enforcement actions and criminal charges. The café owner's fraud claim is legal.
Legal hold: The company's own instruction to keep all information related to an expected lawsuit and stop deleting it, including suspending cleanup rules and log rotation. It overrides normal retention and erasure requests until released.
Legal order: A formal demand from a court or government body that a company must obey, such as a subpoena, warrant or preservation request. It should go straight to legal counsel.
Liability: Being legally responsible for harm.
License: Permission from an authority to do a certain kind of business, such as Kettle & Crane's state food license. It usually comes with conditions.
Lock bypass: A physical test technique: picking locks, or opening doors through gaps under them, to get past a locked door.
Log rotation: Automatic replacement and deletion of old log files on a schedule, such as Kettle & Crane's 90-day web server logs. A legal hold pauses it.
Loss of license: An authority suspends (pauses) or revokes (cancels) a company's license, so it may no longer legally do that work. It is the most severe consequence. Losing the right to take cards is contractual, not loss of license.

M

MAC address: A device's hardware (Media Access Control) address on the local network. Seeing it in Nmap output shows the tester is on the same local network as the target.
Merchant agreement: The contract between a business and its card processing bank. Kettle & Crane's agreement passes on the PCI DSS rules, so the bank's fee is contractual.
Metric: A number that can be tracked and compared, such as days to patch a critical flaw. Benchmarking uses metrics.
MITRE ATT&CK: A free knowledge base of real attacker behavior, organized from tactics (why) to techniques and sub-techniques (how), each with an ID such as T1566. It is used to map coverage and to guide purple team exercises.

N

Negligent: Failing to take reasonable care. The café owner's lawyer claims Kettle & Crane was negligent.
Nmap: A free network scanner, included in Kali Linux, used for ping sweeps, port scans and service detection. Its scans leave clear traces, such as nmaplowercheck requests in web logs.
Non-compliance: Failing to follow a law, contract or agreed standard. It is often a gap nobody noticed, like the unprotected card-number spreadsheet.
Nondisclosure order: A judge's order not to tell the person concerned about a legal request.

O

Observation: An evidence method in which the auditor watches a process as it happens.
OFAC: Office of Foreign Assets Control: the US body that publishes the economic sanctions list of people, groups and countries companies must not trade with.
Offensive testing: Testing from the attacker's side: testers attack to find weaknesses and prove impact. Pen tests and red team exercises are offensive.
Opinion: The formal conclusion an independent practitioner gives in an examination. An 'unmodified' opinion is clean, while 'qualified' or 'adverse' means serious problems.
Opt-in: A consent model in which data can't be used that way until the person actively says yes, so the default is no. A pre-ticked box is never valid opt-in consent under the GDPR.
Opt-out: A consent model in which data may be used until the person says no, so the default is yes. CAN-SPAM unsubscribe links and the CCPA's 'Do Not Sell or Share' link are opt-out.
OSINT: Open-source intelligence: information anyone can find legally, such as websites, job posts, social media and certificate logs. It is the core of passive recon.
Ownership: Who the data belongs to: a data owner is accountable for it inside the company, and contracts keep it the company's property when a vendor holds it. Data subjects still keep their privacy rights.

P

Partially known environment: A pen test in which testers get some information, such as the shop's addresses and one customer account. It saves discovery time and copies what a customer, supplier or insider could do.
Passive reconnaissance: Gathering information without sending anything to the target, such as reading public websites, WHOIS records and certificate logs. The target can almost never detect it.
PCI DSS: Payment Card Industry Data Security Standard: the card brands' security rules for any business that accepts cards. It is enforced mainly through contracts with banks, and it requires quarterly ASV scans and yearly pen tests.
Penetration test: An authorized, simulated attack that tries to exploit weaknesses and prove what an attacker could do. It runs from planning and recon through exploitation and cleanup to a report.
Persistence: A way back into a compromised system that survives a restart, shown during post-exploitation.
Personal data: Any information about an identifiable person, such as a name, email, address, order history or IP address. In the US it is often called PII (personally identifiable information).
Physical penetration test: An authorized test of whether someone can get into buildings or reach equipment, by testing locks, badges, guards and staff habits. At Kettle & Crane, a tester carrying coffee boxes was let in and photographed the network closet.
Ping sweep: An active recon technique that checks which addresses in a range answer.
Pivoting: In the Diamond Model, moving from one known feature to related ones during analysis, such as from a phishing domain to other victims. In pen testing, it means using one compromised machine as a stepping stone to reach others.
Planning: The first pen test phase, in which the company and testers agree on the scope, rules of engagement, dates, contacts and type of test.
Population: The whole group an auditor wants to judge, such as all 40 leavers. The auditor must check that the list is complete before sampling from it.
Port scan: Checking which network ports on a system accept connections, to learn which services run. It is always active recon, and one source hitting many ports in a fraction of a second is its signature.
Port state (open, closed, filtered): Nmap's verdict for each port. Open means a service accepted the connection. Closed means the host replied but nothing listens. Filtered means no reply (or only an ICMP unreachable message) came back, usually because of a firewall.
Post-exploitation: The pen test phase after getting in, in which testers see how far the access goes through privilege escalation, lateral movement, persistence and pivoting.
Preservation request: A US investigator's request that an email or similar provider keep specific records for 90 days (renewable once) while a warrant or order is obtained. It asks the company to keep data, not hand it over.
Pretexting: Pretending to be someone with a reason to be there, such as a delivery driver or printer technician.
Privacy: A person's right to control how their personal data is collected and used. Privacy laws turn it into rights people can use and duties companies must meet.
Privacy notice: The public page that says what data a company collects, why, who it shares it with, how long it keeps it and how to use each right.
Privilege escalation: Gaining higher rights, such as an administrator account, after getting in.
Procedure: In ATT&CK, the exact way one attacker group carried out a technique, recorded from a real attack. It is the P in TTPs.
Processing: Anything done with personal data: collecting, storing, using, sharing or deleting it.
Processing prevention: A person's right to stop one kind of processing for good, such as using their order history to target ads, while their account stays. For direct marketing, the right is absolute.
Processing restrictions: A person's right to have data kept but all use paused for a time, for example while a disputed order is checked. The record is flagged so no system uses it.

Q

QSA: Qualified Security Assessor: a person trained and approved by the PCI Security Standards Council to assess PCI DSS compliance and write the Report on Compliance. Dana is one.
Questionnaire: A written list of questions a person or company answers, such as the 60-question security questionnaire Hearth sent Kettle & Crane. The answers are self-reported claims, not proof.

R

Readiness assessment: A gap analysis done before a formal audit, to find and fix problems while there is still time.
Reasonable assurance: A high level of confidence, though never a guarantee, that an examination gives after enough testing.
Reconnaissance: Gathering information about a target before attacking. It is the first Cyber Kill Chain step and a pen test phase, and it comes in passive and active forms.
Red team: A group that does offensive testing, often in long, goal-based exercises that copy one attacker and try to stay hidden from the defenders.
Regulator: The government body that enforces laws and regulations, such as the FTC or a state attorney general.
Regulatory engagement: An audit or examination done or required by a government regulator under the law it enforces. The company can't refuse, and the findings can lead to fines, sanctions or loss of license.
Report on Compliance: The report a QSA writes after a PCI DSS assessment, listing which requirements are met and which are not.
Reputational damage: Loss of trust among customers, partners and the public, imposed by people's opinion rather than any authority. The Seattle café delaying its deal is an example.
Retention schedule: A table of data types, how long each is kept, why, and what happens at the end. Automatic deletion jobs enforce it.
Retest: A short follow-up test after fixes, to confirm each pen test finding is gone.
Right of access: A person's right to a copy of the personal data a company holds about them and how it is used. The CCPA calls it the right to know.
Right to be forgotten: A person's right to have their personal data deleted. It is not absolute: data required by tax law or under a legal hold may be kept.
Right to data portability: A person's right to get their data in a common machine-readable format, such as CSV, so they can move it to another company.
Roadmap: The plan to close the gaps found in a gap analysis, with owners and dates.
Rules of engagement: The written limits of a pen test: what, when, how, by whom and from which addresses. They told Alex that the 11:40 p.m. scan from 203.0.113.45 was not the authorized test.

S

Sample: The part of a population an auditor actually checks, such as 10 of the 40 leavers.
Sampling: Checking part of a population and using the result to judge the whole. Sampling with testing is the strongest of the four evidence methods.
Sanctions: Official penalties from a government or regulator that restrict what a company may do, such as orders, bans and required audits. A fine alone counts as financial. The word also names economic sanctions lists.
SAQ: Self-Assessment Questionnaire: the PCI DSS form smaller merchants fill in and sign to report their own compliance. Kettle & Crane used one before the breach.
Sarbanes-Oxley Act: A 2002 US law that requires public companies to have an audit committee of independent directors.
Scoping: Setting the limits of audit work before it starts: who may audit, what is included or excluded, and how often checks happen. A clear scope keeps auditors focused on the systems that matter and stops them from wasting time on the ones that don't.
Search warrant: A legal order from a judge, issued when police show probable cause, that lets police search for and take specific items.
Seed: The starting number for random picks. Fixing it, as with random.seed(2026), lets anyone repeat the same sample and check the auditor's work.
Self-assessment: A team or company evaluating its own controls without an outside party. It is cheap and quick but not independent, so it gives the least assurance.
SIG: Standardized Information Gathering: a standard vendor security questionnaire from Shared Assessments.
SOC 2: System and Organization Controls 2: an examination by an independent CPA firm of a service company's controls against the Trust Services Criteria. It includes management's signed assertion and the auditor's opinion.
SOC 2 Type I: A SOC 2 report that checks whether controls are designed well at a single point in time.
SOC 2 Type II: A SOC 2 report that checks that controls are designed well and actually worked over a period, often 6 to 12 months, so it gives more assurance. Alex read the shop platform's 12-month Type II report.
Social engineering: Tricking people rather than machines, often as part of physical tests.
Spoliation: Destroying evidence relevant to a legal case. Under US federal Rule 37(e), a judge can act when such data is lost, and if it was destroyed on purpose can even rule against the company.
Sub-processor: A company a processor hires to do part of the work, such as the cloud host behind the newsletter service. Under the GDPR the processor needs the controller's written authorization before hiring one.
Sub-technique: A more specific way of doing an ATT&CK technique, such as T1566.001 Spearphishing Attachment.
Subpoena: A legal order, issued by a court clerk or attorney under a court's authority, to produce documents or data or to testify. The county prosecutor served one for a customer's shipping records.
Surveillance audit: The smaller yearly audit that keeps an ISO/IEC 27001 certificate valid during its three years.
Survey: Asking many people the same questions and counting the answers, such as Dana's five-question staff survey. It measures awareness across a group, not proof about a system.
SYN packet: The first packet a computer sends to open a TCP connection. Many SYNs from one source to different ports reveal a port scan.

T

Tactic: In ATT&CK, the attacker's goal at a step, the 'why', such as Initial Access or Credential Access. The Enterprise matrix has 15 tactics as of November 2026.
Tailgating: Following an employee through a locked door before it closes. Dana's tester got in this way carrying coffee boxes.
TCP: Transmission Control Protocol: the protocol behind connections to services such as web servers. Nmap's port list shows ports like 80/tcp.
tcpdump: A packet capture tool that prints network traffic. In the lab, the defender used it to watch the scan's SYN packets arrive.
Technique: In ATT&CK, how an attacker reaches a tactic's goal, each with an ID such as T1566 Phishing or T1078 Valid Accounts.
Third party: In auditing, an organization that is neither the audited company (first party) nor its customer (second party), such as an outside audit firm.
Three Lines Model: The Institute of Internal Auditors' model of oversight. The first line runs the business (Alex), the second line sets rules and monitors (compliance), and the third line is internal audit, reporting to the board.
TLS: Transport Layer Security: the protocol that encrypts web and other connections, using certificates. Every TLS certificate issued is recorded in public certificate transparency logs.
Tokenization: Letting the payment processor keep the card number while the company keeps only a stand-in code. Kettle & Crane moved repeat billing to it so it stores no card numbers.
Trust Services Criteria: The criteria a SOC 2 report checks against: security, plus optional availability, processing integrity, confidentiality and privacy.
TTPs: Tactics, techniques and procedures: shorthand for how attackers behave, as catalogued in ATT&CK.

U

Unknown environment: A pen test in which testers get no inside information, often only the company name, like an outside attacker. It is the most realistic choice but slow, and testers may miss systems.

V

Victim: In the Diamond Model, the target of the attack: a person, company, system or email address, such as the cafés that received the fake invoices.
Vulnerability assessment: Scanning and listing weaknesses without exploiting them.
Vulnerability scan: An automated tool run that lists known weaknesses but doesn't prove impact. It runs often, and PCI DSS requires external ones quarterly by an ASV.

W

Walkthrough: During an interview, the person shows the auditor a process step by step on the real system.
War driving: Listening to broadcast Wi-Fi, for example from a parking lot. It counts as passive recon because nothing is sent to the target.
Weaponization: The second Cyber Kill Chain step: building the attack tool, such as a document with a hidden malicious macro.
White team: The referees of a security exercise, who write the rules, watch both sides and judge the results.
WHOIS: The public registration details of a domain name, read during passive recon.