Glossary

226 terms from Secure Infrastructure and Zero Trust, in plain words, each with the chapter that teaches it.

Search the glossary

#

802.1X: An IEEE standard for port-based network access control: a device must authenticate before a switch port or Wi-Fi network lets it in. NAC often uses it to check a device once, when it joins.

A

access review: A scheduled check, often every quarter, where managers confirm each right their staff hold, and anything not confirmed is removed. Together with role-based access, it is a main fix for privilege creep.
active device: A device that acts on traffic: it blocks, drops or resets connections. Inline devices such as an IPS are usually active.
Active Directory (AD): Microsoft's directory service. Accounts on a Windows network live in it, including service accounts such as gMSAs.
adaptive identity: An older SY0-701 term for asking for more proof of identity when risk is higher. SY0-801 doesn't list it, so treat it as background.
Add-KdsRootKey: A PowerShell command that creates the KDS root key once per domain, so domain controllers can compute gMSA passwords.
admin host: A hardened computer in the management zone. A remote admin's session lands there first, and from there the admin opens SSH or RDP to the target server. Older material calls it a jump server.
AES (Advanced Encryption Standard): A widely used symmetric encryption algorithm. In the order server's TLS test, AES with a 256-bit key protected the data in transit.
age: A small file encryption tool. Alex uses it to encrypt the monthly orders export to a recipient's public key before uploading it to cloud storage.
AH (Authentication Header): The part of IPsec that proves a packet is genuine and unchanged but doesn't encrypt it. It travels as IP protocol 51 and breaks when NAT changes addresses.
AllowedIPs: The line in a WireGuard configuration that lists which addresses go through the tunnel. `0.0.0.0/0` (every IPv4 address) makes a full tunnel, and a narrower range such as `10.20.0.0/16` makes a split tunnel.
always-on: A VPN client setting that connects automatically whenever the device has internet, so the user can't forget to use it. Alex turned it on for Sam's trade-show trip.
application access control: Deciding access for each application on its own, instead of letting a user onto the whole network. Priya reaches the shipping app and nothing else.
attack surface: Every point where an attacker could try to get in or cause harm: open ports, services, accounts, remote access paths and devices. The external side is what the internet can reach, and the internal side is what someone already inside can reach.
attestation: Hardware proof of exactly what code is running inside a trusted execution environment. Alex chose confidential computing VMs that offer it.
AUTH TLS: The FTP command that upgrades a connection on port 21 to TLS. This is called explicit FTPS.
authoritative source: The single system of record that drives every account, usually the HR system feeding the identity provider.
automated provisioning: Creating, changing and removing accounts automatically from one authoritative source, instead of by hand on each system.

B

BitLocker: The full disk encryption built into Windows.
BMC (baseboard management controller): A small separate computer inside a server that can power the server on and off and show its screen, even after the operating system crashes. The order server's BMC had to be moved off the staff network.
break glass account: An emergency account kept locked away, used only when normal admin access fails, with every use reviewed. Alex's is local to the order system, so it still works when the identity provider is down.
bypass: A feature on many hardware IPS boxes: when the box loses power, it connects the two cables directly, so traffic flows uninspected. This is fail open built into the hardware.

C

CASB (cloud access security broker): An SSE part that sees and controls how cloud apps are used, and finds unapproved ones. It blocked uploads of the price list to a personal cloud drive.
certificate authority: A trusted organization that issues certificates. A real server uses a certificate from a CA rather than a self-signed one.
cipher suite: The named set of algorithms two sides agree to use for a connection, such as `TLS_AES_256_GCM_SHA384`.
Common port numbers: Numbers that identify network services: 21 FTP, 22 SSH/SFTP/SCP, 69 TFTP (UDP), 443 HTTPS and TLS VPNs, 500 and 4500 IPsec (UDP), 990 implicit FTPS, 3389 RDP, 5432 PostgreSQL, 5900 VNC, 9100 raw printing, 51820 WireGuard (UDP). Firewall rules allow or block traffic by these numbers.
Conditional Access: Microsoft Entra ID's policies, written in JSON, that decide access per app. Alex's policy for the shipping app requires both MFA and a compliant device.
confidential computing: Protecting data in use by running the computation inside a hardware-based, attested trusted execution environment. Alex used it for Morgan's cloud analytics.
console port: A device's built-in admin connection that works even when the device has no network settings.
console server: A box with serial cables to each device's console port. It often has a cellular modem, which let Alex fix a broken firewall rule while locked out.
control diversity: Mixing different kinds of control, such as a technical lock, a written rule and a physically locked door.
control plane: An older SY0-701 term for the Zero Trust parts that decide: the policy engine and the policy administrator.
cryptographic diversity: Using different encryption algorithms or libraries, so not every service depends on one library.
ct state: An nftables match on connection tracking. Kettle & Crane's rule uses it to let replies come back for connections that were already allowed.
CUPS: The Linux print service. Priya's sudo rule lets her restart it and do nothing else.
curl: A command-line tool that makes web requests. Alex used it to reach the order admin page through an SSH tunnel.

D

data at rest: Stored data that isn't moving or being processed, such as on a laptop drive, in a database, in a backup or in a cloud bucket. Encryption, permissions, physical security and key management protect it.
data in transit: Data moving across a network, such as a café's order on its way to the portal. TLS, VPNs, SSH and SFTP protect it.
data in use: Data loaded into memory and being processed, or shown on a screen. It's the hardest state to protect because it must be readable.
data plane: An older SY0-701 term for the policy enforcement point and the traffic it passes.
data states: The three conditions data is always in: at rest, in transit or in use. Each state has its own threats and protections.
data types: The two shapes of data the exam names: structured (fixed fields, like a database table) and unstructured (emails, documents, images, recordings). The type decides how you find and protect sensitive data.
defense in depth: Stacking several layers of protection so that one failure isn't fatal. Diversity builds on it.
deny by default: A firewall approach where everything is blocked unless a rule allows it. Rules then allow only the flows the business needs.
device certificate: A certificate and private key that MDM installs on a device at enrollment. The device proves it holds the key on each connection, which can't be faked the way a MAC address can.
device health: A device's security state at the moment it asks for access: updates, disk encryption, endpoint protection, firewall, not jailbroken, screen lock. Priya's laptop failed it until she installed a missed update.
device inventory: The list of every device the company owns or manages, usually kept in MDM. An unknown device, like Jo's unenrolled tablet, gets no access.
device management: How a company knows its devices and keeps them in good shape. The exam names two parts: inventory and health.
device placement: Choosing where on the network a device goes. The rule is to put a control where the traffic it must see or stop passes, in front of what it protects.
DHCP (Dynamic Host Configuration Protocol): The service that gives each device an IP address when it joins a network. Alex sets it to hand out a different range in each zone.
diversity: Using different vendors, technologies or kinds of control in different layers, so one flaw can't open every layer. The price is more complexity.
DLP (data loss prevention): A control that spots sensitive data, such as card numbers, leaving by email, upload or web form, and blocks it or warns. Alex also used a DLP scan to find card numbers in the customer service mailbox.
DNS (Domain Name System): The system that turns names into addresses. Sam's VPN configuration points to the office name server.
domain controller: A server that runs Active Directory and checks sign-ins. It computes gMSA passwords and hands them to allowed servers.
double ratchet: The Signal Protocol's method of changing the message key with every message, which gives forward secrecy.

E

E2EE (end-to-end encryption): Messages are encrypted on the sender's device and decrypted only on the recipients' devices, so the server relays data it can't read. Morgan used it for the importer negotiation.
edge firewall: The firewall where the internet line enters. It is the first device that incoming traffic meets.
encapsulation: Placing a whole packet inside the data part of another packet with a new outer header, like a letter inside a second envelope. On its own it wraps but doesn't encrypt.
encryption at rest: Encrypting stored data, such as whole disks, databases, files or single columns, so a stolen copy can't be read.
endpoint protection: The security agent on a device that detects malware. A running, up-to-date agent is one of the device health checks, and it also helps protect data in use.
ESP (Encapsulating Security Payload): The part of IPsec that encrypts and protects packets. It travels as IP protocol 50, or inside UDP 4500 when NAT is on the path.
exception-policy: A Suricata setting for what to do when it hits trouble, such as running out of memory. In IPS mode, `auto` mostly fails closed (drops), and `pass-flow` fails open.

F

fail closed: When a device fails, traffic or access is blocked. Kettle & Crane's sign-in and the IPS in front of the order database fail closed.
fail open: When a device fails, traffic or access is allowed, so the business keeps running without that protection. The shop's IPS fails open on Black Friday.
fail-safe: A door lock that unlocks when it loses power, so people can escape. It means safe for people, not for data.
fail-secure: A door lock that stays locked when it loses power, as on the server closet.
failure mode: What a device does when it crashes, loses power or runs out of resources. You choose it ahead of time by weighing availability against security.
FileVault: The full disk encryption built into macOS.
firewall: An inline device that allows or blocks traffic by rules. It goes at the internet edge and between zones.
flow: One kind of traffic: from this zone, to that zone, on this port. In Suricata, a flow means one connection.
forward proxy: A device that makes web requests on behalf of users, for outbound filtering and caching. It sits in front of users, toward the internet.
forward secrecy: A property where stealing one key opens only that message, not earlier ones. The Signal Protocol gets it by changing keys constantly.
FTP (File Transfer Protocol): An old file transfer protocol on TCP port 21 that sends the user name, password and file in plain text. Alex's capture showed Sam's password in the clear.
FTPS: FTP with TLS added. Explicit FTPS upgrades port 21 with `AUTH TLS`, and implicit FTPS uses TLS from the first byte on port 990. It is a different protocol from SFTP.
full disk encryption: Encrypting a whole drive so a thief who removes it can't read the files. It protected Sam's stolen laptop, which a sign-in password alone wouldn't have done.
full tunnel: A VPN setting where all of a device's traffic goes through the company, so company filters see everything. Alex chose it for Sam on hotel Wi-Fi.
FWaaS (firewall as a service): A firewall run in the cloud as part of SSE. It applies the same rules to traffic at home and in the office.

G

gMSA (Group Managed Service Account): An Active Directory service account whose password the domain controller computes and changes automatically, every 30 days by default. Only servers in its allowed group can fetch it, and Kettle & Crane's backup runs as `svc-backup$`.
grantControls: The decision rule inside a Conditional Access policy. Alex's requires both `mfa` and `compliantDevice`, joined by the operator `AND`.
GRE (Generic Routing Encapsulation): A tunnel that wraps packets but doesn't encrypt them. It is often run inside IPsec, as on the Tacoma–Portland routing link.

H

Host addresses (127.0.0.1, 0.0.0.0): 127.0.0.1 is the loopback address: the machine talking to itself, so a service bound to it can't be reached over the network. 0.0.0.0 in `ss` output means a service is listening on every network the server is connected to.
HTTPS: Encrypted web traffic: HTTP protected by TLS, normally on port 443. Plain HTTP is unencrypted.

I

id: A Linux command that shows a user's ID and groups. Alex used `id priya` to spot privilege creep.
identity provider: The service that checks passwords and MFA when users sign in to the company's cloud apps. It provides single sign-on and, fed by HR, can create and remove accounts through SCIM.
IDS (intrusion detection system): A passive device that spots attacks in a copy of the traffic and raises an alert, but can't block. Alex placed one on a port mirror toward the servers.
IETF (Internet Engineering Task Force): The body that writes internet standards, published as numbered RFCs. MLS is one of them.
iifname / oifname: nftables matches for the interface (here, the zone) that traffic comes in from (`iifname`) and goes out to (`oifname`).
IKEv2 (Internet Key Exchange version 2): The protocol IPsec uses to agree on keys. It runs on UDP 500, or UDP 4500 through NAT.
implicit trust zone: An older SY0-701 term for the trusted area behind a PEP, which should be kept as small as one resource.
impossible travel: Sign-ins from places too far apart for the time between them, like Portland and another country 35 minutes apart. Alex's policy denies them.
in-band management: Managing devices over the same network that carries normal traffic. It's simple, but you lose it when that network breaks.
inline: Sitting in the traffic path, so every packet passes through and can be blocked. Firewalls, IPSs and WAFs are inline.
Install-ADServiceAccount: A PowerShell command run on each allowed server to install a gMSA there.
IoT (Internet of Things): Small connected devices such as cameras and label printers. They are hard to patch, so they get their own low-trust zone.
IP protocol numbers (50, 51): Numbers in the IP header that name what a packet carries: 50 is ESP and 51 is AH. They are protocol numbers, not ports, so a firewall passing IPsec without NAT must allow protocol 50 separately.
IPMI (Intelligent Platform Management Interface): The protocol older BMCs use for remote server management.
IPS (intrusion prevention system): An inline, active device that spots attacks and blocks them. It usually sits just inside a firewall.
IPsec (Internet Protocol Security): A family of standards that secures each IP packet, using IKEv2 to agree keys and ESP to encrypt. It is common for site-to-site VPNs such as Portland–Tacoma.

J

jailbroken: Describes a phone whose built-in protections have been removed. A device that is jailbroken or rooted fails the device health check.
JSON: A text format of labeled fields in curly brackets. Conditional Access policies are written in it, and it is an example of semi-structured data.
just-in-time access: Giving admin rights only for the minutes they are needed, then taking them away.

K

KDS root key: The secret, created once per domain, that domain controllers use to compute gMSA passwords. KDS stands for Key Distribution Service.
key management: Keeping encryption keys safe and apart from the data, so a stolen disk or backup doesn't carry its own key.
key pair: A public key that others can use, and a private key that never leaves the device. E2EE apps, WireGuard and age all use them.

L

L2TP (Layer 2 Tunneling Protocol): An older VPN tunneling protocol that doesn't encrypt on its own, so it is usually paired with IPsec.
LAN (local area network): The network inside one building or site, joined by switches.
least privilege: Giving each person the smallest access the job needs, for no longer than needed. It limits which systems, which actions and for how long, as with Priya's one-command sudo rule.
least privilege access accounts: A separate account for each kind of work, each with only that work's rights. Examples are Alex's everyday `alex` account and the admin-only `alex-admin`.
load balancer: A device that spreads requests across several servers. It sits in front of the group of servers.

M

MAC address: A network card's hardware address. It can be changed in seconds, so it's a weak signal for proving which device is connecting.
managed file transfer (MFT): A product category: a server that adds logging, alerts, retries and approval steps on top of SFTP or HTTPS. Pick it when a regulator or partner wants proof of each transfer.
management zone: The highest-trust and smallest zone, holding admin workstations and device consoles. Only it may open admin connections such as SSH into the other zones, and remote admins land there first.
masking: Hiding part of a value, for example showing only the last four digits of a card number, so people see only what they need. The next book teaches it in full.
MDM (mobile device management): Software that enrolls laptops and phones, pushes settings to them, installs device certificates and reports their health. Kettle & Crane's device inventory lives in it.
metadata: Data about a message rather than its content: who talked to whom, when and how much. E2EE doesn't hide it from the provider.
MFA (multifactor authentication): Proving identity with two or more different kinds of proof, such as a password plus a code from a phone app. Zero Trust expects it for every session.
Microsoft Entra ID: Microsoft's cloud sign-in service. Its Conditional Access policies follow the documented Microsoft Graph policy format.
MLS (Messaging Layer Security): An IETF standard (RFC 9420, 2023) for efficient end-to-end encryption in groups of two to thousands of members.
mover process: Treating a job change like leaving one job and joining another: old access off, new access on. It would have removed Sam's old shipping groups.
multicast: Traffic sent to many receivers at once. Routing protocols use it, and GRE can carry it while plain IPsec can't.

N

NAC (network access control): Checks a device's posture once, when it joins the network or a switch port, often with 802.1X. Zero Trust instead checks health on every request.
NAT (network address translation): Rewriting addresses as packets pass, which home routers do. It can break IPsec, so IPsec then wraps ESP in UDP port 4500.
network tap: A small box that copies every packet on a cable to a monitoring device. That device is passive and can't block.
New-ADServiceAccount: A PowerShell command that creates a gMSA. Its `-PrincipalsAllowedToRetrieveManagedPassword` option names the group of servers allowed to fetch the password.
nftables: The firewall built into Linux. Alex wrote Kettle & Crane's zone rules for it and read the drop counter with `nft list chain`.
NIST SP 800-207: The best-known description of Zero Trust architecture, from the US National Institute of Standards and Technology. It defines the decision point and the enforcement point.

O

on-path attack: An attacker places themselves in the middle of a connection to read or change data in transit.
openssl s_client: A command that connects to a server the way a browser does and prints the TLS version and cipher both sides agreed on. Alex used it to check the order server.
out-of-band management (OOB): Managing devices through a separate path that doesn't depend on the production network, such as a management network, console server, cellular modem or BMC. It still works when the main network is down.

P

pass-flow: A Suricata exception-policy value that lets traffic continue with no more inspection of that flow. This is fail open.
passive device: A device that only watches and reports, such as an IDS on a tap. It can't stop traffic.
passkey: A phishing-resistant sign-in where the device proves the user with a key that works only for the real site.
perimeter model: The old design where one wall surrounds the network and everything inside it is trusted.
phishing-resistant: Describes authentication that can't be typed into a fake website, such as a passkey.
policy administrator: The part of the policy decision point that carries out the engine's decision by telling the PEP to open or close the session.
policy decision point (PDP): The Zero Trust brain that decides each request. It is made up of the policy engine and the policy administrator.
policy drop: The nftables default policy that drops anything not explicitly allowed. This is deny by default.
policy enforcement point (PEP): The door guard in front of a resource. It holds each request, asks the PDP, and then lets the session through or blocks it.
policy engine: The part of the PDP that weighs the signals against policy and decides: allow, allow with limits, ask for more proof, or deny.
port mirror (SPAN port): A switch setting that copies one port's traffic to another port, where a monitoring device such as an IDS can watch it.
post-quantum ratchet: A feature Signal added in October 2025 so its encryption can resist future quantum computers.
PostgreSQL: A database server, normally on port 5432. The portal reaches the order server's PostgreSQL through one narrow firewall rule.
PowerShell: Windows' command shell. Alex uses it to create and test gMSAs.
PPTP: An old VPN protocol that is broken and never the secure answer.
privilege creep: The slow build-up of access a person no longer needs, from job changes and temporary grants that were never removed. Four of Priya's six groups were creep.
privileged account: An account with administrator rights, like `alex-admin`. It is used only for admin work, with MFA, from an admin workstation, and never for email or browsing.
production network: The network and systems doing the company's real work. Out-of-band management uses a path that doesn't depend on it.

R

RAM (random access memory): A computer's working memory. Data must be loaded there in readable form to be processed, which makes it data in use.
RDP (Remote Desktop Protocol): A protocol on TCP port 3389 for controlling a Windows desktop over the network. It should never be open to the internet, as Sam's was.
Redfish: A newer standard from the DMTF (Distributed Management Task Force) for managing servers through their BMC.
redundancy: Two copies of the same thing, so one can take over if the other fails. Unlike diversity, it doesn't stop one flaw from beating both.
remediation: Bringing an unhealthy device back to a healthy state, such as by installing a missing update, so its next request passes.
remote access: Any way of using or managing a system from somewhere else. It should go through a VPN or ZTNA and a logged path from the management zone.
remote access VPN: A VPN that joins one device to a network through a client on the device, like Sam's laptop connecting from a hotel.
resource: In Zero Trust, the thing the subject wants to reach, such as the shipping app or a file share.
reverse proxy: A device that takes inbound requests for servers, hides them and can end TLS. It sits in front of servers, often in the screened subnet.
RFC: One of the IETF's numbered internet standards documents, such as RFC 9420 for MLS and RFC 4217 for explicit FTPS.
role-based access: Granting access by job role, with one group per role, so a job change swaps the whole role and removes old access in one step.
root: The all-powerful administrator account on Linux. Priya's sudo rule runs one command as root.

S

safety number: A code in an E2EE app that two people compare, or scan as a QR code, to confirm no one swapped their public keys.
SAML: A standard used for single sign-on. It handles sign-in only, not creating or removing accounts.
SASE (secure access service edge): An older term for a bundle of SSE plus networking services. SY0-801 names SSE instead.
schema: A database's list of tables and columns. It proved the shop database had no card number column.
SCIM (System for Cross-domain Identity Management): The standard protocol an identity provider uses to tell each cloud app to create, change or delete accounts when HR records a hire, a move or a leaver.
SCP (Secure Copy): A simple file copy command over SSH on port 22. Recent OpenSSH runs it over SFTP.
screened subnet (DMZ): A zone for servers the internet must reach, such as the wholesale portal, with firewalls screening both sides. Kettle & Crane's rules call it `dmz`.
security zone: A group of systems that share the same trust level and rules. Traffic between zones must pass a firewall, so a taken-over guest phone stays stuck in the guest zone.
self-signed certificate: A certificate signed by its own server rather than by a trusted certificate authority. Tools show a verification warning for it, as in Alex's lab.
semi-structured data: Data with labeled fields but no fixed table, such as JSON, XML or log lines.
sensor: A device that collects traffic or events for monitoring. It goes where the traffic of interest passes.
service account: An account used by a program rather than a person, like the nightly backup's account. Its old, shared passwords make it a favorite target.
SFTP (SSH File Transfer Protocol): File transfer inside an SSH connection on port 22, which encrypts both the login and the file. The cafés upload order files to Kettle & Crane's SFTP server.
Signal Protocol: The E2EE protocol used by Signal and WhatsApp. It changes the message key with every message.
signals: Facts about a request that the policy engine weighs: user identity, device, application and context.
single sign-on (SSO): One sign-in through the identity provider for many apps. It handles sign-in only, so unlike SCIM it doesn't remove a leaver's local accounts.
site-to-site VPN: An always-on VPN between gateways that joins two whole networks, like the Portland office and the Tacoma warehouse.
sMSA (standalone managed service account): An older type of managed service account that works on only one server, unlike a gMSA.
sniffing: Capturing network traffic to read it. It is a main threat to data in transit.
split tunnel: A VPN setting where only company-bound traffic goes through the VPN and everything else goes straight to the internet.
ss: A Linux command that lists network ports. With `-tln` it shows listening TCP ports by number; Alex used it to find the portal's open doors.
SSE (Security Service Edge): A cloud service near the users that applies SWG, CASB, ZTNA, FWaaS and DLP to their traffic, wherever they are.
SSH (Secure Shell): An encrypted command-line admin login on TCP port 22. At Kettle & Crane, only the management zone may use it.
SSH port forwarding: Using `ssh -L` to carry one port's traffic through an encrypted SSH connection. Alex reached the order admin page this way from home.
standard user account: An everyday account with no admin rights, like `alex`, used for email, the web and documents.
structured data: Data in a fixed format where every item has the same fields, like rows in the order database. You can protect it field by field.
subject: In Zero Trust, who or what is asking for access: a person, with a device, using an app.
sudo: A Linux tool that runs a command with higher rights. `sudo -l -U priya` lists what Priya may run.
sudoers: The rule files for sudo, under `/etc/sudoers.d/`. Priya's rule allows exactly one command.
Suricata: A widely used open-source IDS and IPS. Its behavior when it fails is set by `exception-policy` in `suricata.yaml`.
SWG (secure web gateway): An SSE part that filters web traffic: it blocks malicious and banned sites, such as a fake login page Sam clicks, and scans downloads.
systemctl: The Linux command that starts, stops and restarts services, for example `systemctl restart cups`.

T

TCP (Transmission Control Protocol): The connection-based protocol most services use, with delivery checks.
technology diversity: Layers that work in different ways, such as operating system patches plus a separate IPS that blocks the same attack.
TEE (trusted execution environment): A protected area inside the processor where code and data are isolated and memory is encrypted, so even the operating system or cloud provider can't read them. It protects data in use.
Test-ADServiceAccount: A PowerShell command that returns True if a server can fetch a gMSA's password.
TFTP (Trivial FTP): A plain file transfer protocol on UDP 69 with no login. Use it only for device configs and firmware, never for sensitive files.
threat scope reduction: An older SY0-701 Zero Trust term that SY0-801 doesn't list. Treat it as background only.
TLS (Transport Layer Security): The encryption behind HTTPS that protects data in transit. TLSv1.3 is the current version.
TLS VPN (SSL VPN): A VPN carried inside TLS on TCP 443. It looks like web traffic, so it works from hotel networks that block most ports.
transport encryption: Encryption only between each device and the provider's server, usually with TLS. The server can read the messages.
transport mode: An IPsec mode that keeps the original IP header and encrypts only the data inside. It is used host to host, and often for GRE inside IPsec.
tshark: A command-line packet analyzer. Alex used it on saved captures (.pcap files) to show FTP's clear-text password and SFTP's encrypted traffic.
tunnel: A way to carry one kind of traffic inside another by encapsulation. A tunnel is encrypted only if its protocol encrypts.
tunnel mode: An IPsec mode that encrypts the whole original packet, header included, and adds a new outer header. It is used between site-to-site gateways.

U

UDP (User Datagram Protocol): A faster protocol without delivery checks. IPsec key exchange, WireGuard and TFTP use it.
unstructured data: Data with no fixed format, such as emails, documents, PDFs, photos and recordings. It is most of a company's data, and it is protected by place, by file and by content scanning.
user authentication: Proving who the user is. In Zero Trust it happens for every session and resource, with strong MFA, and it continues during the session.
user management: Creating, changing and removing accounts: one per person, access by group, MFA before first use, expiry dates, and same-day removal of leavers like Taylor.
user-agent string: Text a browser sends to identify itself. It is easily faked, so it's a weak device signal.

V

vendor diversity: Using layers from different makers, such as an edge firewall from vendor A and an internal firewall from vendor B, so one product flaw opens only one layer.
VLAN (virtual local area network): One switch acting as several separate LANs. It is the real boundary of each zone.
VNC (Virtual Network Computing): A screen-sharing protocol on TCP 5900. Many versions have weak or no encryption.
VPN (virtual private network): An encrypted connection across the untrusted internet that makes a remote device or office behave as if it were on the private network.
VPN client: A small program on a laptop or phone that connects to the company's VPN gateway.
VPN gateway: A firewall or router that ends VPN connections at a site.
vulnerability: A weakness in one of the doors of the attack surface. Closing an unneeded port shrinks the surface even if that port has no known vulnerability.

W

WAF (web application firewall): An inline device that filters attacks aimed at one web application. It sits directly in front of that application, like the wholesale portal.
WAN (wide area network): A network that links sites across large distances. In security zoning, the WAN usually means the connection out to the internet, which is treated as the untrusted zone outside the firewall (for example, the `wan` interface on Kettle & Crane's firewall).
wg genkey / wg pubkey: WireGuard commands: one makes a private key, and the other derives its public key.
wg-quick strip: A command that reads a WireGuard configuration and prints it back only if it is valid. Alex used it to check both tunnel files.
WireGuard: A small, modern VPN protocol with few settings and SSH-like keys. It uses one UDP port (often 51820), and Sam's laptop uses it.

X

XML: A text format with labeled fields. It is an example of semi-structured data.

Z

Zero Trust: The principle of never trusting a request because of where it comes from, and verifying every request. An office laptop gets no more trust than one in a café.
Zero Trust architecture (ZTA): The design that puts Zero Trust into practice. A PEP in front of every resource asks a PDP to decide each request, using the user, device, application and context.
zone matrix: A table with one row per source zone and one column per destination zone, listing the only traffic allowed in each cell. Each filled cell becomes one firewall rule.
ZTNA (zero trust network access): A service that acts as the PEP for private apps, connecting a user to one app at a time without exposing it to the internet. Priya reaches the shipping app through it.