Endpoint, Application and Email Security

Glossary

281 terms from Endpoint, Application and Email Security, in plain words, each with the chapter that teaches it.

Search the glossary

#

802.1X: An IEEE standard that keeps a switch port or Wi-Fi connection closed until the device proves who it is to an authentication server, almost always RADIUS. Alex uses it so a stranger's laptop plugged into a meeting-room socket can't reach the order server.

A

acceptable use policy: The rules staff or guests agree to before using company systems. Guests accept it on the tasting room's captive portal, and staff sign it when they receive a device.
account lockout: A setting that locks an account after too many wrong passwords. Alex uses Group Policy to lock accounts for 15 minutes after 10 failed tries.
accounting: Keeping accurate records of every asset: what it is, who has it, what it is worth and which licenses it uses. For software, that means counting licenses owned against licenses installed.
acl: A line in a Squid configuration that gives a name to a group of requests, such as 'gambling' for a domain or 'badfiles' for addresses ending in .exe. The http_access rules then use those names.
acquisition: The life cycle stage where the company gets an asset, ideally from a trusted source through a defined buying process that includes a security review.
Active Directory: Microsoft's directory service that holds a company's user accounts and computers. Group Policy uses it to send settings to computers and users.
agent: A small program installed on a device that runs in the background all the time and takes its rules from a central console. One agent often handles several jobs, such as web filtering, DLP, endpoint protection and inventory reporting.
agent-based filtering: Web filtering done by an agent on each device, so the filter goes wherever the device goes. It protects Sam's laptop on café Wi-Fi, but can't cover printers or guest phones.
agentless: A posture check that needs no installed software: it asks the device over the network or reads its state from a management tool such as MDM.
aggregate report: A daily XML summary that receiving mail servers send to the domain owner, showing how many emails claiming to be from the domain passed or failed DMARC and which servers sent them. Alex uses these reports to find every genuine sender.
alignment: The DMARC check that the domain which passed SPF or DKIM matches the domain in the visible From line. Relaxed alignment accepts the same organizational domain, while strict needs the exact same name.
allow list: A rule that describes what good input looks like and rejects everything else, such as accepting a zip code only if it is exactly five digits. It is stronger than a block list because it doesn't need to know every attack.
antivirus: Software that scans files for malware using signatures, heuristics and behavior monitoring, then quarantines or removes what it finds. It catches known malware files but misses new, changed and fileless malware.
AP (access point): The device that provides a Wi-Fi network. In 802.1X it acts as the authenticator, and an unknown one plugged in under a desk is a serious risk.
API key (application programming interface key): A long code that lets one program use another program's service, such as the payment processor's. It is a secret, so it must never be committed to a repository.
AppArmor: A mandatory access control system used by Ubuntu and some other Linux systems. It works like SELinux, but its profiles name file paths instead of labels.
application security: The practices that make software itself hard to attack, such as input validation, secure cookies, static code analysis and code signing for the Kettle & Crane shop.
AppLocker: A Windows application control feature that uses allow lists to decide which programs may run. Alex can push its rules with Group Policy.
ARC (Authenticated Received Chain): An email standard that lets forwarders and mailing lists pass on the SPF, DKIM and DMARC results they saw, so a later receiver can still trust them.
asset: Anything of value to the company. The exam groups assets as hardware (laptops, switches), software (programs, licenses, cloud services) and data (the customer list, payroll files).
asset inventory: The list of every asset the company has, with details such as tag, owner, location and support end date. It records what the company should have, and enumeration checks that against what is really there.
asset management: Knowing every asset the company has, who is responsible for it, where it is and what state it is in, from planning to disposal. You can't protect a laptop nobody remembers.
asset management life cycle: The stages every asset passes through: plan, acquire, assign, monitor and dispose. The asset's record is updated at each stage, and each stage closes a different security gap.
asset tag: A physical label with a number and a barcode or QR code that is stuck on each device, such as KC-0142. It links the device to its inventory record.
asset tracking: Keeping the inventory accurate while assets are in use: where each one is, whether it is still used, and whether it is still secure. It compares the records with enumeration scans.
assignment: Giving each asset an owner and, for devices, a user, with a tag, a record and a signed handover. It makes someone accountable for every asset, so a missing laptop gets noticed.
audit: A regular check that compares the asset records with reality, for example a yearly walk around the office with a barcode scanner.
ausearch: A Linux command that searches the audit log. ausearch -m AVC lists SELinux denials, which is how Alex found the image files with the wrong label.
authentication server: The 802.1X role that decides whether a device may join, almost always a RADIUS server that checks credentials against the company directory.
Authentication-Results: An email header that the receiving server adds to record results such as spf=pass, dkim=fail and dmarc=fail. It is the first place to look when investigating a suspicious email.
authenticator: The 802.1X role played by the switch or Wi-Fi access point. It relays sign-in messages and opens or keeps closed the port, but doesn't make the decision itself.
authenticity: Proof of who published or sent something. A code signature proves authenticity because only the publisher holds the private key.
Authenticode: Windows' code signing format. Windows checks it automatically to show who published a program, and shows 'Unknown' when the program isn't signed.
AVC (access vector cache): The part of SELinux that makes access decisions. Every denial is written to /var/log/audit/audit.log as an AVC message showing the blocked action, the program, its source context (scontext) and the target's context (tcontext).
AWS (Amazon Web Services) access key: A cloud credential. Its access key ID has a fixed shape (AKIA followed by 16 capital letters and digits), so secrets scanners recognize it, as Gitleaks did in Alex's label script.

B

Bandit: A free static analysis tool for Python. On the old shop code it flagged SQL built from strings (B608) and a shell=True command (B602), each with a severity.
behavior monitoring: An antivirus method that watches what a program does as it runs, such as encrypting hundreds of files in a minute, rather than just what the file looks like.
BIMI (Brand Indicators for Message Identification): An email standard, published as a TXT record at default._bimi, that lets a company's logo appear next to its emails, but only when they pass DMARC at enforcement. It rewards good email authentication and doesn't authenticate anything itself.
BitLocker: Windows' built-in disk encryption, which Alex can turn on for every computer through the Computer Configuration half of a GPO.
Block Inheritance: A Group Policy option on an OU that stops GPOs from higher levels applying to it, except GPOs marked Enforced.
block list: A rule that describes bad input, such as quote marks or <script>, and lets everything else through. Attackers can write the same attack in many ways, so block lists always miss something.
booleans: On/off switches in SELinux that grant common extra permissions without rewriting the policy. For example, httpd_can_network_connect lets the web server make network connections.
boto3: A Python library for Amazon Web Services. Alex's shipping label script imported it to upload labels to cloud storage.
buffer overflow: An attack that sends far more data than a program has room for, so the extra data spills into nearby memory. Input validation that checks length helps stop it.
build pipeline: The automated steps that test and package each code change. Secrets scanning and Bandit can run there and block a change with a high-severity finding.

C

CA (certificate authority): An organization that checks a publisher's or company's identity and issues certificates, such as code signing certificates or BIMI's VMC. A CA can also revoke a certificate.
CA/Browser Forum: The group whose rules public CAs follow. Its rules require code signing keys to be kept in certified hardware (since June 2023) and limit public code signing certificates to 460 days (since March 2026).
canonicalization: Turning encoded input, such as %27 or %2e%2e%2f, back into its plain form, or a file name into its full real path, before checking it. Otherwise the check sees harmless characters while the application sees an attack.
captive portal: A web page a new device must see and act on before it gets internet access, like the one guests use on the tasting room Wi-Fi. It neither encrypts traffic nor checks device health, so it suits guests rather than staff.
centralized proxy: One proxy server on the network path that all office web traffic goes through, so it can filter every office device and keep one log. It can't see traffic that never reaches it, such as Sam's laptop at a café.
certificate: A signed file that ties a public key to a name, which devices use to trust a website, proxy, server or publisher. TLS inspection, EAP-TLS and code signing all depend on certificates.
certificate of destruction: A document from a disposal company listing each drive's serial number, the method, the date and who did the work. It proves to auditors and regulators that the drives were really destroyed.
certification: The proof that sanitization actually happened, usually a certificate of destruction or sanitization. Sanitization removes the data, and certification documents it.
CIS Benchmarks (Center for Internet Security): Hardened configuration guides published by the Center for Internet Security. Like Microsoft's security baselines, they give a secure starting point for settings.
ClamAV: A free, open-source antivirus scanner that checks files against signatures, including custom ones such as a one-line hash signature. For example, it can flag the harmless EICAR test file even when it is disguised as `invoice.pdf.exe`.
clamscan: The ClamAV command that scans files or folders, reporting matches as FOUND and clean files as OK. The -d option chooses the signature database to use.
clear: The lightest NIST sanitization level: overwrite data with normal commands or do a factory reset. It is fine when a laptop stays inside the company, for example when it goes to a new employee.
client-side validation: Input checks done in the browser, usually with JavaScript. They help users spot mistakes, but attackers can skip them, so they aren't a security control.
CMC (Common Mark Certificate): A BIMI certificate for a logo that isn't trademarked but has been in use for at least a year.
CMDB (configuration management database): An asset inventory that also records how assets depend on each other. Larger companies use one, while Kettle & Crane keeps its records in an IT management tool.
code signing: The publisher signs a hash of its program with its private key, and users' computers check the signature with the public key before running it. It proves who published the code and that nobody changed it, but not that the code is safe.
code signing certificate: A certificate from a CA that ties a publisher's identity to the public key used to check its code signatures. If the signing key is stolen, the publisher must have the certificate revoked.
command injection: An attack where user text reaches a shell command, so input such as '; rm -rf /' runs as a second command. Bandit flags subprocess calls that use shell=True for this reason.
commit: A snapshot of changes that Git saves, with the author, date and a message. A secret removed in a later commit still sits in the earlier one, as in Alex's commit 5d2601b.
Computer Configuration: The half of a GPO that applies to computers whoever signs in, such as firewall rules or BitLocker. The other half, User Configuration, follows users to whatever computer they use.
content filter: A control that looks at what flows in and out of the company, such as web pages, files and emails, and blocks what breaks the rules, such as gambling sites or .exe downloads. Unlike a firewall, it judges the content, category or file type rather than the address and port.
cookie: A small piece of data a website asks the browser to store and send back with every later request to that site.
correlation: Linking related alerts from different sources, such as email, sign-ins and endpoints, into one incident with one timeline. It is XDR's main job.
counterfeit hardware: Fake or tampered devices, often sold cheaply by unknown sellers, that may contain hidden malware or spying chips. Buying from the manufacturer or its authorized resellers is the control.
cryptographic erase: A purge method for fully encrypted storage: destroying the encryption key makes all the data unreadable at once. It is also how to sanitize cloud data that was encrypted with the company's own key.
CSRF (cross-site request forgery): An attack where a page on another site makes the victim's browser send a request, such as 'change the email address', to a site where they are signed in. The SameSite cookie attribute defends against it.
curl: A command-line tool that sends web requests and shows the replies. Security staff use it to check a server's response headers, such as whether `Set-Cookie` includes the `Secure`, `HttpOnly` and `SameSite` attributes.
custodian: The person who looks after an asset day to day for its owner: backing it up, patching it and keeping it secure. Alex is the custodian of the customer database that Sam owns.

D

DAC (discretionary access control): Normal Linux permissions, where each file's owner decides who may read or change it. Any program runs with all its user's rights.
DAST (dynamic application security testing): Testing that attacks the running application from outside, as an attacker would, for example with a web vulnerability scanner. It finds real, reachable problems but can't point to the line of code.
data at rest: Data stored on file shares or cloud storage. Storage DLP scans it, for example to find a payroll spreadsheet saved in a folder everyone can open.
data classification: Marking data with a level such as Internal, Restricted, Confidential or Public so the right controls apply. DLP can act on these labels, and planning uses them to decide how strong a device's protection must be.
data discovery: Tools, often part of DLP, that find where sensitive data is stored, such as a customer list copied to a file share.
data in motion: Data moving across the network, such as email leaving the mail server or files uploaded through the web. Network DLP watches it.
data in use: Data being worked with on a device, such as copying to USB, printing or pasting into a website. Endpoint DLP watches it with software on each laptop.
data retention: Keeping data as long as law and policy require before deleting it. For example, US tax rules require employment tax records to be kept for at least four years.
decommissioning: Taking an asset out of service. The steps are: check data retention, remove access, sanitize the storage and update the inventory.
degaussing: Wiping magnetic media with a strong magnet, which counts as a purge method. It does not work on solid-state drives.
destroy: The strongest NIST sanitization level: shred, disintegrate, pulverize, melt or incinerate the media. It is used for the most sensitive data or broken drives, such as the old order server's disks.
DHCP (Dynamic Host Configuration Protocol): The service that hands out network addresses to devices. RFC 8910 lets it also announce a captive portal's address.
dig: A DNS lookup tool. Alex uses it to read Kettle & Crane's SPF, DKIM, DMARC and BIMI TXT records.
digital signature: A hash signed with a private key, which anyone with the matching public key can check to see who signed it and that it hasn't changed. Code signing and DKIM both use digital signatures.
directory traversal: An attack that uses ../ sequences, or encoded forms such as %2e%2e%2f, in a file name to reach files outside the intended folder, such as ../../etc/passwd. The fix is to canonicalize the name, then accept it only from an allow list of files or only if it stays inside the permitted folder.
disposal: Getting rid of an asset by recycling, reselling, donating or destroying it, while making sure no data leaves with it.
dissolvable agent: A posture-checking program that downloads when a device connects, runs its checks once, then removes itself. It suits unmanaged contractor laptops.
DKIM (DomainKeys Identified Mail): An email standard where the sending server signs headers and body with the domain's private key, and receivers check the signature with the public key published in DNS. It detects changed messages and usually survives forwarding.
DKIM-Signature: The header DKIM adds to an email. Its fields include d= (signing domain), s= (selector), a= (algorithm), h= (signed headers), bh= (body hash) and b= (the signature).
DLP (data loss prevention): Tools and rules that recognize sensitive data, such as card numbers, and stop it leaving, whether by mistake or on purpose. When a rule matches, DLP can block, warn, encrypt or log, which is how Alex stops staff emailing card numbers.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): The policy layer on top of SPF and DKIM, published at _dmarc in DNS. It checks that a passing domain aligns with the visible From line, tells receivers what to do with failures, and sends reports to the domain owner.
DMARC policy (p=none, p=quarantine, p=reject): The p= tag tells receivers what to do with email that fails DMARC: p=none only sends reports (fake email is still delivered), p=quarantine usually sends it to spam, and p=reject refuses it at delivery. Roll out from none to reject; quarantine and reject count as enforcement, which BIMI needs.
DMARC tags (sp=, np=, t=): Extra DMARC record tags: sp= sets a policy for subdomains, np= sets one for subdomains that don't exist, and t= (testing) replaced the old pct= tag in the May 2026 update (RFC 9989).
DNS (Domain Name System): The internet's directory, which turns names such as shop.kettleandcrane.com into addresses. Only the domain owner can change its records, so SPF, DKIM, DMARC and BIMI are published there.
domain controller: A server that runs Active Directory. Domain controllers refresh Group Policy every 5 minutes instead of about every 90.

E

EAP (Extensible Authentication Protocol): The framework for the sign-in messages used in 802.1X. The EAP method chosen, such as EAP-TLS or PEAP, decides what proves identity.
EAP-TLS: The strongest EAP method: both the device and the server prove themselves with certificates, so there is no password to steal. Kettle & Crane's staff laptops use it with device certificates.
EAP-TTLS: An EAP method like PEAP: it builds an encrypted tunnel first, then the user signs in inside it. It supports more kinds of inner sign-in.
EAPOL (EAP over LAN): The frames that carry EAP messages between the laptop and the switch. Between the switch and the server, EAP travels inside RADIUS messages instead.
Ed25519: A newer key type that DKIM also allows, alongside RSA.
EDR (endpoint detection and response): Software with an agent on each device and a central console that records activity (telemetry), detects attack chains such as Word starting PowerShell, and lets the team respond, for example by isolating a laptop. It catches attacks that use no known bad file.
EICAR test file: A harmless file that every antivirus vendor detects, used safely to test that scanning works.
endpoint: Any device a person or program uses at the edge of the network: a laptop, desktop, server or phone.
endpoint posture: A device's security state: its patches, protections such as antivirus and disk encryption, and its settings.
endpoint security: Controls that protect the devices themselves, such as antivirus, EDR and XDR. They are the last line of defense once an attacker reaches a laptop.
Enforced: A Group Policy option that stops lower-level GPOs from overriding a GPO and also gets past Block Inheritance. Alex marks the USB-blocking GPO Enforced.
entropy: A measure of how random a string looks. Secrets scanners flag long, high-entropy strings, especially near words such as 'password' or 'secret'.
enumeration: Discovering and listing what is actually there, for example by scanning the network for every connected device. Comparing it with the inventory reveals unknown or missing devices.
envelope sender: The sender address servers use, given in the SMTP MAIL FROM command and used for bounce messages. It can differ from the From line the reader sees, and SPF checks only this address.
environment variable: A value the operating system gives a program when it runs. It is a safer place than the code for keeping secrets.
EOL (end of life): The date after which a product stops getting security updates. A laptop or program near its end of life is a poor buy, and monitoring flags assets approaching it.
evil twin: A fake access point using the same network name as a real one. Certificate warnings that continue after sign-in, or a second access point with Kettle & Crane's guest name, point to one.
explicit proxy: A proxy setup where each browser or device is configured with the proxy's address, often pushed out by Group Policy.

F

false positive: A warning about something that is actually safe, such as Bandit's low-severity note about the subprocess module. A person must review findings and mark the false ones.
fileless malware: Malicious code that runs only in memory or the registry and never saves a program file to disk. Antivirus finds nothing, but EDR can see the behavior.
fingerprinting: A DLP method that stores a hash of an exact document, such as the wholesale price list, so copies or large parts of it are recognized even if renamed.
firewall: A control that allows or blocks traffic by address and port. A content filter, by contrast, judges what the traffic contains.
firmware: The built-in software that runs a hardware device such as a network switch. Antivirus can't inspect it for tampering, so buying from a trusted source matters.
forward proxy: A proxy that makes web requests on behalf of the users going out to the internet, such as Kettle & Crane's office proxy.
full disk encryption: Encrypting everything on a drive, so the data is unreadable without the key. It is a posture rule and a planning requirement, and it makes cryptographic erase possible.
fullmatch: A Python pattern check that passes only if the whole input matches the pattern. The shop's zip code check uses it with \d{5}, meaning exactly five digits.
fuzzing: A kind of dynamic testing that sends huge amounts of random or malformed input to a program to find crashes.

G

Gatekeeper: The macOS feature that checks apps are signed and notarized by Apple before they run.
getenforce: A Linux command that shows the current SELinux mode: Enforcing, Permissive or Disabled.
Git: The tool most companies use to store code and its full history as a series of commits.
git log: A Git command that lists a repository's commits, newest first. With --oneline it prints one short line per commit.
GitHub: A hosted service that keeps a shared copy of Git repositories for a team. Its push protection blocks pushes that contain known secret types.
Gitleaks: A free secrets scanner that found Alex's AWS key in an old commit even though the current file no longer had it. With --no-git it scans only the current files and misses secrets left in the history.
GPO (Group Policy Object): A named set of Group Policy settings that an administrator links to part of Active Directory, such as the domain or an OU. Every computer and user there receives it.
gpresult /r: A Windows command that shows which GPOs applied to the computer and the signed-in user. Alex uses it to confirm the USB block applied.
gpupdate /force: A Windows command that applies all Group Policy settings immediately instead of waiting for the background refresh.
Group Policy: The Windows feature that applies settings, such as account lockout or blocking USB storage, to many computers and users from one place through Active Directory. Computers outside AD can use Local Group Policy.
Group Policy Management Console: The Windows tool where administrators edit GPOs and link them to parts of the directory.
Group Policy refresh: Computers apply GPOs at startup and user settings at sign-in, then Windows reapplies them in the background about every 90 minutes plus a random 0 to 30 minutes. This puts back settings someone changed by hand.

H

hardcoded secret: A password or key pasted straight into code, like the AWS keys in Alex's label script. Anyone who can read the repository can read it.
hardening: Removing weaknesses by changing settings. Group Policy and SELinux help harden Windows and Linux.
hash: A short fingerprint of a file's bytes that changes completely if even one byte changes. DLP fingerprints, antivirus signatures, code signing and DKIM all rely on hashes.
header From: The From line the reader sees in their mail app. Attackers forge it, and DMARC checks that it aligns with a domain that passed SPF or DKIM.
heuristics: Rules of thumb antivirus uses to spot malware it has no signature for, such as a packed program or an Office macro that downloads files.
HIPS (host-based intrusion prevention system): Software that blocks suspicious actions on one host using rules. Unlike EDR, it doesn't keep central telemetry for investigation.
Host addresses (127.0.0.1, 0.0.0.0): 127.0.0.1 is the loopback address. It means "this machine itself", so it is often used to run a test proxy, web server or DNS server that only the local computer can reach. 0.0.0.0 means "no specific address", and when a server listens on it, it means "every address on this machine".
HSM (hardware security module): Certified hardware that keeps private keys safe. Public CA rules require code signing keys to live in an HSM or hardware token.
HTTP status codes: Three-digit codes a web server or proxy sends back to say how a request went: 200 OK means it succeeded, and 403 Forbidden means it was refused. In the Squid log, TCP_DENIED/403 means the content filter blocked the request.
http_access: Squid rules that allow or deny requests matching an acl. They are read from the top, the first match wins, and the last rule denies everything else.
HttpOnly: A cookie attribute that stops scripts in the page from reading the cookie, so an XSS attack can't steal the session cookie.
HTTPS (Hypertext Transfer Protocol Secure): The encrypted version of HTTP, the web protocol, using TLS. A proxy can still see the site's name, but it needs TLS inspection to see inside the traffic.

I

IEEE (Institute of Electrical and Electronics Engineers): The organization that writes many networking standards, including 802.1X.
include:: An SPF part that also allows every server listed in another domain's SPF record, such as the newsletter service's. Each include costs one of the 10 allowed DNS lookups.
input validation: Checking that input has the expected type, length, range and format before using it. It should be done on the server, preferably with allow lists, so attacks such as SQL injection and XSS are rejected.
integrity: Proof that something hasn't been changed. Code signing and DKIM both prove integrity, because one changed byte breaks the signature.
Intune: Microsoft's cloud device management service, which can push settings to computers that aren't in Active Directory.
isolation: An EDR response that cuts a device off from the network while it can still talk to the console. It stops the spread and keeps the evidence, as with Jo's laptop.

J

jailbroken: Describes a phone whose built-in protections were removed. Posture rules require that devices are not jailbroken or rooted.

K

keyword matching: A DLP method that flags data containing chosen words such as 'Confidential' or 'Payroll'.

L

legal hold: An order to keep data for a lawsuit, which overrides normal deletion and disposal schedules.
living off the land: An attack that uses only tools already on the system, such as PowerShell or WMI, so antivirus finds no bad file. EDR catches it from the chain of behavior.
LSDOU: The order GPOs are applied in: local, site, domain, then OU. The last one applied wins unless a higher GPO is Enforced.
Luhn check: A simple math test that every real card number passes. Adding it to a DLP digit pattern cuts false alarms from Kettle & Crane's order numbers.

M

MAC (mandatory access control): An access control model where a central policy written by the administrator decides what each program may do, and users and programs can't change it. SELinux adds it to Linux; it is unrelated to a MAC address.
MAC address: The hardware address of a device's network card. Captive portals and MAC authentication bypass use it, but attackers can copy it, so it identifies a device only weakly.
MAC authentication bypass: A switch feature that lets devices that can't run a supplicant, such as label printers, in by their MAC address. It is weaker, so such devices go on a restricted VLAN.
macro: A small program inside an Office file. A document whose macro downloads files is a classic warning sign.
malware: Software made to cause harm, such as viruses, worms and ransomware.
MD5 (Message Digest 5): An older hash algorithm that produces a short fingerprint of a file's bytes; it is too weak for signatures today but still used to identify files. Alex's ClamAV signature used the EICAR file's MD5 hash.
MDM (mobile device management): A tool that manages phones and laptops: it reports their state and location and can lock or wipe a lost device. It feeds agentless posture checks and asset tracking.
MDR (managed detection and response): A service whose analysts watch the EDR console day and night, which suits a small company like Kettle & Crane.
MITRE ATT&CK: A public catalog of attacker techniques. Many EDR tools use it to label their detections.

N

NAC (network access control): Tools that decide which devices may join the network and what they may reach, by asking who are you, are you allowed, and are you healthy. Captive portals, 802.1X and posture checks are NAC tools.
native XDR: XDR from one vendor that covers that vendor's own endpoint, email and cloud products.
network discovery: Scans that find devices on the network, including ones with no agent such as printers or unknown devices. Alex's scan found 18 devices when the inventory listed 16.
NGAV (next-generation antivirus): Modern antivirus that adds machine learning and more behavior checks to signatures.
NIST SP 800-88 (National Institute of Standards and Technology Special Publication 800-88): The US guide to media sanitization, updated to Revision 2 in September 2025. It defines three levels: clear, purge and destroy.
non-repudiation: The signer can't deny having signed, because only they hold the private key. Code signing provides it.

O

offboarding: The process when someone leaves the company. The asset records show everything they were given, such as a laptop, phone, security key and service access, so it can all be collected or removed.
on-demand scan: An antivirus scan of a whole disk or folder, run when someone asks or on a schedule.
open XDR: XDR that collects data from many vendors' tools rather than one vendor's own products.
opendkim-genkey: A command that generates a DKIM key pair. Alex used it with -b 2048 to make a 2048-bit RSA key.
OpenSSL: A free cryptography toolkit. Alex used it to sign label-tool.sh and to show that one added line causes 'Verification failure'.
openssl dgst: The OpenSSL command that hashes a file and, with -sign, signs it using the private key or, with -verify, checks the signature using the public key.
OU (organizational unit): A folder inside an Active Directory domain, such as 'Shipping' or 'Laptops', that GPOs can be linked to. An OU's GPO is applied last, so it normally wins.
output encoding: Turning characters such as < into < when a page displays user input, so the browser shows the text instead of running it. It is the main defense against XSS.
OWE (Opportunistic Wireless Encryption): A Wi-Fi mode that encrypts each guest's traffic without needing a password, closing the gap an open guest network leaves.
owner: The person accountable for an asset, who decides how it is classified and who may use it. Sam owns the customer database.

P

parameterized query: A database query that sends the SQL and the values separately, with ? as a placeholder, so input is always treated as data and never as code. It is the best defense against SQL injection.
pattern matching: A DLP method that recognizes data by its shape, such as a Social Security number's 3-2-4 digits, or a card number of 13 to 19 digits that passes the Luhn check.
PEAP (Protected EAP): A common EAP method where a username and password are sent inside an encrypted tunnel protected by the server's certificate.
penetration test: A test where experts attack an application to find weaknesses. Done yearly, it finds problems months after the code is written.
permerror: A permanent SPF error that happens when checking a record needs more than 10 DNS lookups. SPF then fails for every email.
persistent agent: Posture-checking software that stays installed on company devices and reports their state all the time.
phishing: Fake messages that trick people into acting, such as an email 'from Sam' asking a café to pay into a new bank account. Spoofed senders power most phishing.
planning: Planning decides what assets are needed and which security features they must have, such as a TPM and enough years of updates. Scoping decides which assets the program covers, including shadow IT.
polymorphic malware: Malware that changes its own code each time it spreads, so its hash changes and signatures no longer match.
posture check: Checking a device's patches, protections and settings against company rules before or while it uses the network. Failing devices go to a remediation network, as Alex set up for contractor laptops.
PowerShell: A Windows tool for running commands that attackers often abuse, for example when Word starts PowerShell to download a file. It can be set to run only signed scripts.
pre-commit hook: A check that runs on the developer's machine and refuses a commit if it finds a secret.
private key: The secret half of a key pair, held only by its owner and used to sign. If a publisher's signing key is stolen, attackers can sign malware that computers trust.
procurement process: The company's defined way of buying: who may request, who approves and which suppliers may be used. It includes a security review, inspection on arrival and adding the asset to the inventory.
proxy: A server that makes requests on behalf of other computers, which lets it check and filter web traffic.
public key: The shareable half of a key pair, used to check signatures. It sits in a code signing certificate, and for DKIM it is published in DNS.
purge: A NIST sanitization level that defeats even laboratory recovery, using secure erase, cryptographic erase or degaussing. It suits devices that leave the company but keep working, such as the leased laptops.
push protection: A GitHub feature that blocks pushes containing known secret types. As of November 2026 it is on by default for every user pushing to public repositories.

Q

QR code (quick response code): A square, two-dimensional barcode printed on asset tags that a scanner reads to identify the device.
quarantine: Moving a suspected malware file into a locked area where it can't run but can be restored if it was a false alarm. EDR can quarantine files too.

R

RADIUS (Remote Authentication Dial-In User Service): The server that acts as the 802.1X authentication server. It checks credentials against the directory, answers accept or reject, and can name the VLAN a device joins.
ransomware: Malware that encrypts files to demand payment. Some EDR products can roll back the files it encrypted.
real-time scan: An antivirus scan that checks each file as it is opened, saved or downloaded.
redirect: An instruction that sends the browser to a different page. A captive portal redirects every request to its own page until the guest acts.
remediation network: A restricted VLAN for devices that fail a posture check. It reaches only update servers and help pages until the device is fixed and checked again.
repository: The place where a project's code and its full history are stored, such as Kettle & Crane's shop-scripts repository.
restorecon: A Linux command that restores files' correct SELinux labels. It is the right fix when files moved from a Samba share keep the samba_share_t label.
revoke: Disabling a key or certificate so it is no longer trusted. After a secret leaks, revoking or rotating it is the first step, and a stolen signing key needs its certificate revoked by the CA.
RFC (Request for Comments): A numbered internet standard. Examples are RFC 7208 (SPF), RFC 9989 (DMARC) and RFC 8910 (captive portal announcement).
RFID (radio frequency identification): Asset tags that can be read from a distance by radio.
RSA (Rivest, Shamir and Adleman): A public-key algorithm named after its inventors, used for Kettle & Crane's 2048-bit DKIM key.
rua=: The DMARC tag that names where receivers send aggregate reports. ruf= asks for failure reports about single messages.

S

S/MIME: An email encryption standard that keeps mail private. Like SMTP TLS, which encrypts mail between servers, it doesn't stop a forged From line.
Samba: Software that provides Windows-style file sharing on Linux. Its shared files carry the SELinux type samba_share_t, which the web server isn't allowed to read.
SameSite: A cookie attribute that controls whether the cookie is sent on requests that start on another site, which defends against CSRF. Strict never sends it, Lax sends it only on normal top-level link clicks, and None always sends it (and needs Secure).
sanitization: Making data on storage impossible to recover, by clearing, purging or destroying it. Deleting files or formatting a drive doesn't count.
SAST (static application security testing): Static code analysis used for security, such as running Bandit on the shop's code.
SBOM (software bill of materials): A list of the components inside a piece of software, which lets the company check them for known vulnerabilities.
secret: Anything that grants access, such as a password, API key, access token or private key. Once committed to a repository, it must be treated as known to attackers.
secrets manager: A vault service that stores secrets and hands them to programs when they run, so keys never sit in code.
secrets scanning: Automatically searching code and its full history for secrets by known patterns and entropy. It works best before commit, at push, in the build pipeline and across history.
Secure: A cookie attribute that makes the browser send the cookie only over HTTPS. This keeps it from being captured on open café Wi-Fi.
secure cookie: A cookie set with attributes (Secure, HttpOnly, SameSite) that make it hard to steal or misuse, plus a short life and no sensitive data inside.
secure email gateway: A filter for incoming spam, malware, links and attachments that protects your own users. DMARC, by contrast, protects other people's inboxes from mail forged in your name.
secure erase: A drive's built-in command for wiping all its data, which counts as a purge method.
security baselines: Recommended hardened GPO settings published by Microsoft as a secure starting point.
selector: A label that tells receivers where to find a DKIM public key, at selector._domainkey.domain, so a domain can keep several keys and change them over time. Kettle & Crane's selector is mail2026.
SELinux (Security-enhanced Linux): A Linux kernel feature, first developed by the NSA, that adds mandatory access control. It labels every process and file and denies anything the policy doesn't allow, so a hijacked web server stays confined.
SELinux context: The label on every SELinux process and file, in the form user:role:type:level. The type part, such as httpd_t or httpd_sys_content_t, matters most.
SELinux modes: Enforcing blocks and logs denials, Permissive only logs what would be denied, and Disabled turns SELinux off. Keep it enforcing; the startup mode is set in /etc/selinux/config.
server-side validation: Input checks done on the server, which attackers can't skip. It is the validation that actually protects the shop.
session cookie: A cookie holding a long random ID that tells the server a request comes from someone already signed in, such as Jo on the shop's admin page. While the session lasts, it is as valuable as the password.
session hijacking: Stealing a session cookie and sending it from the attacker's own browser to act as the victim.
Set-Cookie: The response header a server uses to set a cookie and its attributes, such as Path=/, Secure, HttpOnly and SameSite. A cookie with no Expires or Max-Age is deleted when the browser closes.
setenforce: A command that switches SELinux to permissive (0) or enforcing (1) until the next restart.
setsebool: A command that turns an SELinux boolean on or off. -P makes the change last after restarts.
SHA-256 (Secure Hash Algorithm, 256 bits): A hash algorithm used to fingerprint files and messages before signing, both in Alex's OpenSSL code signing and in DKIM.
shadow IT: Cloud services or devices that staff start using without IT's knowledge. Scoping and identity provider service lists help find them, and an easy procurement process discourages them.
SIEM (security information and event management): A system that collects logs from almost everything, keeps them for search and compliance, and runs alert rules the team writes. It covers more sources than XDR but has less built-in response.
signature: A pattern that identifies one known piece of malware, such as a file hash or a byte string. It is exact, so false alarms are rare, but changing one byte defeats it, and it must be kept up to date.
SMTP (Simple Mail Transfer Protocol): The protocol that carries email. It lets the sender write any From address without checking it, which is why SPF, DKIM and DMARC exist.
SPF (Sender Policy Framework): A TXT record that lists the servers allowed to send email for a domain. Receivers check it against the envelope sender, and it breaks when email is forwarded.
SPF record endings (-all, ~all, ?all, +all): The all part at the end of an SPF record says what happens to servers not on the list: -all fail (receivers may reject), ~all softfail (accept but mark suspicious), ?all neutral (no statement), and +all pass (anyone may send, so never use it). Kettle & Crane's record ends in -all.
spoofing: Faking the sender of an email, for example writing sam@kettleandcrane.com in the From line to trick a café into paying a fake invoice.
SQL (Structured Query Language): The language used to talk to databases, such as the shop's orders database.
SQL injection: An attack where SQL typed into a form field becomes part of the database command, such as 97214' OR '1'='1. Parameterized queries are the main fix.
Squid: A free proxy server. Kettle & Crane's lab configuration, squid.conf, blocks a gambling domain and .exe downloads.
Squid access log: The proxy's record of each request: time, duration, client address and result. TCP_DENIED/403 with HIER_NONE means blocked without contacting the site, while TCP_MISS/200 with HIER_DIRECT means fetched directly and delivered.
SSE (Security Service Edge): Cloud security services that include a provider-run proxy, so a device's web traffic is filtered from anywhere.
static code analysis: Checking source code for weaknesses without running it, such as SQL built from strings or hardcoded passwords. It is fast and points to the exact line, but produces false positives.
supplicant: The 802.1X role played by the device asking to join, such as Sam's laptop, using software built into its operating system.
supply chain attack: An attack through a trusted supplier, such as stealing a publisher's signing key to sign malware, or tampered hardware from an unknown seller.
SVG (Scalable Vector Graphics): An image file format. BIMI logos must be SVG files in a special restricted format.

T

tamper protection: Settings that stop users, even those with administrator rights, from stopping or removing a security agent. Without it, a disabled agent leaves the device unfiltered.
telemetry: The continuous record an EDR agent sends to the console: which programs start, what started them, file changes, network connections and who was signed in. It survives even if the attacker wipes the device.
timestamping: Adding a trusted time to a code signature, so the signature stays valid after the certificate expires.
TLS (Transport Layer Security): The encryption that HTTPS uses. EAP-TLS uses it for certificate-based network sign-in.
TLS inspection: A proxy decrypting HTTPS traffic, checking it, and encrypting it again. Every device must trust the proxy's certificate, and banking and health sites are usually skipped for privacy.
TPM (Trusted Platform Module): A security chip that protects encryption keys. It must be required at planning, because no setting can add a missing chip later.
transparent proxy: A proxy that the network quietly sends web traffic to, so users configure nothing and may not know it is there.
TXT record: A DNS record that holds text. SPF, DKIM, DMARC and BIMI are all published as TXT records.
type enforcement: SELinux rules that allow one type to act on another, such as 'httpd_t may read httpd_sys_content_t'. Anything without a rule is denied.

U

URL encoding: The way web addresses carry special characters, such as %27 for a quote mark. Attackers use it to slip past block lists, so input must be decoded before it is checked.
USB (Universal Serial Bus): The common port for drives and other devices. Copying data to a USB drive is a DLP concern, and Group Policy can deny all removable storage.

V

vendor assessment: Checking a software or cloud vendor's security before buying: encryption, multifactor sign-in, security updates and independent audit reports.
VLAN (virtual local area network): A separate network that shares the same switches. Kettle & Crane puts guests, printers and failing devices on their own VLANs.
VMC (Verified Mark Certificate): A BIMI certificate that proves a company owns a registered trademark for its logo. With it, Gmail also shows a blue check mark.

W

WMI (Windows Management Instrumentation): A built-in Windows management tool that attackers abuse when living off the land.
WPA2-Enterprise / WPA3-Enterprise: Wi-Fi security modes that use 802.1X, so each person signs in with their own account instead of a shared password.
WPA3-Personal (Wi-Fi Protected Access 3): Wi-Fi encryption that uses a shared password, for example one written on a board for guests.

X

XDR (extended detection and response): An extension of EDR that collects telemetry from endpoints, email, identity, network and cloud, correlates the alerts into one incident, and can respond across all those layers from one console.
XML (Extensible Markup Language): A text format for data, used for DMARC aggregate reports.
XSS (cross-site scripting): An attack where script code entered as input runs in other visitors' browsers, for example to send document.cookie to the attacker. Output encoding is the main fix, and HttpOnly cookies limit the damage.

Z

Zero Trust: The idea that nothing is trusted once and for all. Device health is checked again for every access, which is what posture checks do.