Glossary

169 terms from Threats, Threat Actors and Motivations, in plain words, each with the chapter that teaches it.

Search the glossary

A

Accidental/unintentional: A trusted person who causes harm by mistake, without meaning to. Jo emailing next year's prices to the wrong 'Jo' from the address book is an accidental actor, not an insider.
account takeover: Taking control of someone's real account, often by tricking them into sharing a verification code. The attacker then messages the victim's contacts, who trust the sender.
Advanced persistent threat (APT): A highly skilled, well-funded attacker that gets into a network and stays hidden there for a long time to reach a goal, often espionage. APT describes the style of the campaign (long, hidden, patient). It does not say who is behind it.
Attack Complexity (AC): A CVSS metric that says whether special conditions are needed to exploit a flaw. AC:L (Low) means no special conditions are needed.
Attack Requirements (AT): A Base metric added in CVSS 4.0 that records whether the attack depends on particular conditions in the target's setup.
attack surface: All the vectors a company is open to. Every new app, account or device at Kettle & Crane adds to it, and removing things it doesn't need shrinks it.
Attack Vector (AV): A CVSS metric for how an attacker reaches the flaw: N (network, over the internet), A (adjacent network), L (local) or P (physical). It is different from the general term 'attack vector', which means a threat vector.
attributes: The three traits that describe what any threat actor can do: internal or external, resources/funding, and level of sophistication/capability.
Automated Indicator Sharing: A free threat feed run by the US agency CISA.

B

Black Basta: A ransomware gang that, since 2024, has flooded victims' inboxes with junk mail and then posed as the help desk in Microsoft Teams to get a remote support session.
black hat: An unauthorized hacker who uses flaws for harm or profit. Black hats do not have an ethical motive.
booter: A cheap paid service that floods a website with traffic. Unskilled attackers often buy one to knock sites offline.
bug bounty: A public program where a company pays people who find and report flaws in its products. Hunters who test under the program have an ethical motive.
business email compromise (BEC): Breaking into or faking a real business mailbox to redirect payments, such as the fake Bloom Café email asking Sam to send a refund to a new account. It needs no malware, only a convincing request.

C

call-back rule: A rule to confirm any payment change or unusual request by contacting the person through a channel you already trust, such as the phone number on file. It works even when the message itself looks perfect.
CIA triad: The three goals of security: confidentiality (only the right people see data), integrity (data stays correct) and availability (systems work when needed). Stolen cards hurt confidentiality, changed prices hurt integrity, and a shop that won't load hurts availability.
CISA: The Cybersecurity and Infrastructure Security Agency, a US government agency. It publishes advisories, runs the Automated Indicator Sharing feed and the KEV catalog, and sponsors the CVE program.
CNA: A CVE Numbering Authority: an organization allowed to assign CVE IDs. Apache was the CNA for the Log4j flaw.
collaboration tools: Workplace platforms for chat, meetings and shared files. They are a message-based vector because staff trust them and outside accounts, such as a fake 'Help Desk (External)', can message staff.
competitor: A rival business that attacks to gain an advantage, such as stealing customer lists or disrupting a big sale. If a rival recruited or paid an insider, the actor is the competitor.
CompTIA Security+: An entry-level IT security certification exam from CompTIA. Its current version, SY0-801, includes objectives 2.1 to 2.3 on threats, vulnerabilities, threat actors, motivations and threat vectors.
Computer Fraud and Abuse Act: A US computer crime law. Testing systems without permission, as a gray hat does, can break it even when the intent is good.
crime syndicate/organized crime: A criminal gang that attacks computers for money and runs like a business, with managers, specialists and payment handlers. It is the most likely serious attacker for a small shop like Kettle & Crane.
critical infrastructure: Services a society depends on, such as power, water, hospitals, communications and transport. Their failure frightens the public, so terrorists and state-sponsored groups target them.
cryptocurrency: Digital money that attackers often demand as ransom or steal from exchanges. Some attackers also secretly use a victim's computers to 'mine' it, which leaves the victim paying the power bill.
CVE: Common Vulnerabilities and Exposures: a public list that gives each known vulnerability a unique ID. It is sponsored by CISA and run by MITRE. CVE names the flaw, while CVSS scores it.
CVE ID: The unique name of a flaw in the form CVE-year-number, such as CVE-2021-44228 for Log4j. The year is when the ID was assigned or reserved, which is not always when the flaw was found.
CVSS: The Common Vulnerability Scoring System, maintained by FIRST. It gives a flaw a severity score from 0.0 to 10.0 along with a vector string. It measures how severe a flaw is, not your own risk.
cvss (Python library): A free Python library that calculates CVSS scores and severity ratings from vector strings such as `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`. It supports CVSS 3.1 and 4.0, so you can see how changing a single metric changes the score.
CVSS metric groups: In CVSS 4.0, the four groups of metrics: Base (the flaw itself), Threat (whether attackers use it now), Environmental (your own setting) and Supplemental (extra facts that don't change the score).
CVSS-B / CVSS-BT / CVSS-BE / CVSS-BTE: CVSS 4.0 labels that show which metric groups a score includes: Base only, Base plus Threat, Base plus Environmental, or all three. Most published scores are CVSS-B.
CWE: Common Weakness Enumeration: MITRE's list of software weakness types. The Log4j record lists CWE-20, 'Improper Input Validation', which describes the kind of coding mistake behind the flaw.

D

dark web: A part of the internet reached only with special software, often used to sell stolen data such as logins.
dark web monitoring: An intelligence source: a service that watches the dark web for your company's name, logins or customer data. One might find a forum post selling 'Kettle & Crane shop admin login'.
DDoS: A distributed denial-of-service attack, which floods a website with traffic from many sources so real customers can't reach it. Attackers may threaten one unless they are paid.
defacement: Changing a website to show the attacker's message, such as a protest banner on the shop's home page. It is a common hacktivist method and a sign of notoriety when signed.
denial of service: An attack that stops real users from reaching a service, usually by flooding it with traffic, as happened to the shop during the holiday sale.
detection: Noticing an attack once it has started, for example by watching for unusual logins, new administrator accounts or large night-time uploads. It is needed against well-funded or skilled attackers who may get past prevention.
directory traversal: A software flaw where input such as ../ climbs out of the allowed folder to read other files. The clue is ../ in a web address or file name.
disgruntled: Angry and resentful, usually describing an employee. It is a clue word for an insider acting on purpose, often out of revenge.
disinformation: False stories spread on purpose, often through fake accounts, to sway public opinion. It is a tool of the influence motive.
display name: The free-text name shown for an email sender, such as 'Bloom Cafe Accounts'. Anyone can type any name, so check the actual address in angle brackets.
DKIM: DomainKeys Identified Mail: an email standard that adds a digital signature proving a message came from the signing domain and wasn't changed on the way.
DMARC: Domain-based Message Authentication, Reporting, and Conformance: an email standard that ties the SPF or DKIM result to the From domain the reader sees, and publishes the domain owner's policy for failures. It is the only one of the three that both checks the visible address and tells receivers to reject forgeries.
double extortion: An attacker copies data before locking it with ransomware, then threatens to publish it too. Good backups get the files back but don't remove the threat to publish.
dwell time: The time between an attacker's first break-in and its discovery. In the booking-computer scenario it was 95 − 1 = 94 days. Defenders aim to keep it short.

E

end-of-life: A vulnerability type: a product whose maker sends no more fixes, like Kettle & Crane's old router. No patch will come, so the only options are replacing it or adding controls around it.
end-to-end encryption: Encryption from one device all the way to the other, so carriers, companies and anyone in the middle can't read or scan the content. Many chat apps use it and RCS increasingly can, but SMS does not.
envelope sender: The hidden return address that mail servers use, separate from the From address the reader sees. SPF checks only this.
EPSS: The Exploit Prediction Scoring System from FIRST. It gives each flaw a probability from 0 to 1 that it will be exploited in the next 30 days, so 0.89 means about an 89% chance. It measures likelihood, not severity.
espionage: A motive: secretly gathering confidential information over a long time without being noticed, like the hidden email rule forwarding Sam's hotel bid messages. It can be government or corporate (industrial).
ethical: A motive where someone hacks to improve security and reports flaws instead of exploiting them. White hats do this with permission, and gray hats without.
exfiltration: Copying data out of a victim's network, often slowly and disguised as normal traffic. It is a method, not a motive.
exploit: To actually use a vulnerability. The code or trick used to do it is also called an exploit. A public exploit makes attacks much more likely.
Exploit Maturity (E): The key CVSS 4.0 Threat metric: attacked (A), proof of concept (P, meaning working attack code exists but no real attacks are known) or unreported (U). The same flaw scored 9.3 with E:A and 8.1 with E:U.
external: An actor outside the organization who has never been given access. An outsider using a stolen staff login is still external.
extortion: A motive: getting money or something else by threatening harm, usually with a deadline, as in 'pay $15,000 by Friday or we post your customer list'. Pick it over financial when a threat appears and extortion is one of the options.

F

FBI: The Federal Bureau of Investigation, the US federal police agency. It issues threat alerts and, through its Internet Crime Complaint Center, tracks reported internet crime losses.
fear/chaos: A motive where the harm itself is the goal: panic and disorder, often through wipers, shutdowns and threats, with no demands. Shutting down Portland's card terminals with 'Tomorrow, food' is an example.
financial: The most common motive: the attacker wants money, through fraud, theft and resale, direct theft or stolen computing. A fake 'new bank details' email to Sam is financially motivated.
firewall: A device or program that allows or blocks network traffic by rules. One that reads a threat feed can automatically block or flag bad addresses and domains.
FIRST: The Forum of Incident Response and Security Teams, the group that maintains CVSS and EPSS.

G

general curiosity: A motive where the attacker just wants to see what is possible, like the customer who changed order=1052 to 1051, looked, and left. It is still unauthorized, but there is no boasting, no demand and no report.
gray hat: A hacker who tests without any permission but usually reports the flaws found. 'Semi-authorized' is an older CompTIA label and does not mean partial permission. A gray hat who reports still has an ethical motive but may break the law.
GSMA: The GSM Association, the mobile industry's trade body, which designed RCS.

H

hack and leak: Stealing real documents and publishing them, sometimes edited, at a chosen moment to embarrass a target or swing opinion.
hacktivist: An attacker (hacker plus activist) who promotes a social or political cause through defacement, floods or leaks, aiming for attention rather than money or harm to people.
hardware and firmware: A vulnerability type: flaws in chips or in the software built into devices, such as a flaw in the router's firmware.
hash: The short fingerprint of a file. Threat feeds share hashes of malware files as indicators of compromise.
human and process: A vulnerability type: people or procedures that can be tricked or skipped, such as paying a changed bank account without checking. It is fixed with training and better procedures, not software.

I

ideological: A motive driven by a belief system (religious, environmental, social or economic), such as defacing the site with a 'fair coffee' manifesto. It differs from political, which is about who governs.
impact: How much harm a threat would do if it happened (financial, operational, reputational, legal, safety), rated 1 to 5. Likelihood asks 'how probable?', and impact asks 'how bad?'.
indicator of compromise (IOC): A small fact that shows an attack, such as a bad web address, an attacker's IP address or a malware file's hash. Threat feeds mostly carry these.
influence: A motive to change what people think, believe or decide, for example 300 fake one-star reviews claiming Kettle & Crane coffee made people sick.
initial access: The APT stage where the attacker gets a first foothold, often with a carefully written message to one employee or through a flaw in an internet-facing device.
injection: A software flaw where input is treated as a command, such as SQL typed into a search box. The clue is code or query words inside a form field.
insider: A person who is or was trusted with access (staff, former staff, contractors, partners) and harms the company on purpose, like Sam exporting the café list before leaving.
instant messaging: Internet chat apps that use accounts and support files, voice and video. Attackers use them for impersonation and account takeover, as in the fake 'owner' WhatsApp request to Jo, outside any company filter.
intellectual property: Valuable knowledge a company owns, such as designs, code, formulas or Kettle & Crane's espresso roast profiles. As a motive, it means the attacker wants to use that know-how.
intelligence sources: The places threat intelligence comes from: OSINT, proprietary sources, information-sharing organizations (ISACs), government, dark web monitoring and internal sources such as your own logs.
internal: An actor inside the organization who was given access, including employees, contractors and former staff whose accounts still work. Internal actors start past most defenses.
internal sources: An intelligence source made of your own logs, past incidents and staff reports, such as the firewall log showing nightly login attempts on the shop's admin page.
ISAC: An Information Sharing and Analysis Center, a members-only group in one industry (such as retail) where members quietly share threat details with each other.

K

KEV catalog: CISA's free list of flaws with proof of real attacks, each with a due date for US federal agencies. A flaw listed in KEV, like the shop plugin flaw, goes ahead of one with a higher score that isn't listed.

L

lateral movement: The APT stage where the attacker spreads from the first computer to others, looking for the target data.
least privilege: Giving each person only the access their job needs. It limits the damage an insider can do.
likelihood: An estimate of how probable it is that a threat will happen, rated 1 to 5 (rare to almost certain). It depends on interest, ease, exposure and existing controls, and it jumps when a public exploit appears.
Log4j: A widely used Java logging library that is built into thousands of programs. Its 2021 flaw, CVE-2021-44228, scored CVSS 10.0 Critical and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, so it is a common example of a severe, actively exploited vulnerability.
lookalike domain: A sender domain that looks almost right, such as kett1eandcrane.com or kettleandcrane.co. It differs from spoofing, which forges the exact real address.
lure: The reason a malicious message gives you to act fast without thinking: urgency, authority, fear or reward.

M

malware: Software built to do harm, such as ransomware or a wiper.
memory flaw: A software flaw where a program puts more data, or attacker code, into memory than it should, overwriting what is next to it. Buffer overflow and memory injection are kinds; clues are oversized input, a crash, or code run from memory.
message-based vector: A threat vector that reaches a person through a message: email, SMS, RCS, instant messaging or collaboration tools. It is the most common way attacks begin.
misconfiguration: A vulnerability type: correct software set up unsafely, like a cloud folder of invoices left public. Whoever set it up fixes it.
missing patch: A vulnerability type: a fix exists but hasn't been installed, like the shop plugin one version behind. It differs from end-of-life, where no fix exists.
MITRE: A US nonprofit that runs the CVE program and keeps the CWE list of weakness types.
MLS: Messaging Layer Security, the encryption standard now in the RCS specification. It enables end-to-end encryption between iPhone and Android, which began rolling out in beta in 2026.
multifactor login: A login that asks for a second proof, such as a code from your phone, after the password. It stops most low-resource attackers.

N

NIST: The US National Institute of Standards and Technology. It runs the NVD and describes an APT as an adversary with sophisticated expertise and significant resources.
notoriety: A motive: wanting fame, so the attacker signs and brags about the work, as with '0wned by c0ldbrew_kid' on the blog. Spies and most criminals want the opposite.
NSA: The US National Security Agency, one of the agencies that warned about Volt Typhoon.
NVD: NIST's National Vulnerability Database, which adds scores and details to CVE records.

O

OASIS: The Organization for the Advancement of Structured Information Standards, which publishes the open STIX and TAXII standards.
OSINT: Open-source intelligence: anything public and legal to read, such as news, advisories or a free vendor blog. The test is access, not author, and it must be checked because anyone can post.

P

p=reject: A DMARC policy setting that tells receiving servers to refuse emails that fail the check, such as forged invoices claiming to come from kettleandcrane.com.
patch: A fix released by the maker for a software flaw. Attackers study published patches, so the gap between a patch's release and your install is the danger window.
payload: What a malicious message delivers: a link, a file, or a request such as 'pay this invoice'. The vector is the channel, and the payload is what travels along it.
penetration tester: Someone hired to attack a company with written permission and report what they find, like the tester who listed the router password in a written report.
persistence: The APT stage of installing hidden ways back in, such as extra accounts or malware that restarts at boot, so cleaning one laptop doesn't remove the attacker.
phishing: Fake emails or sites, sent to many people, that try to steal logins or install malware.
PIN: A personal identification number. Chat apps use it as part of two-step verification.
political: A motive aimed at government and power: changing a law, swaying an election or weakening a country, such as 'Repeal the van tax'.
prioritization: Putting vulnerabilities in fix order by weighing severity (CVSS), real exploitation (KEV), predicted exploitation (EPSS), asset value, and exposure and controls. Exploited and exposed beats a slightly higher score.
privilege escalation: The APT stage of gaining more rights, for example getting an administrator's login.
Privileges Required (PR): A CVSS metric for whether the attacker needs a login. PR:N means none, and PR:L means a low-level login.
proprietary sources: Paid, closed intelligence from security companies, usually well checked and with analysts' advice. A paid report from the same company that writes a free blog is proprietary, while the blog is OSINT.

R

race condition: A software flaw where the attacker acts in the gap between a check and the action that follows it. An example is two orders using a $50 gift card at the same instant, so it pays twice.
ransomware: Malware that locks files until a ransom is paid, often in cryptocurrency. It is the top worry in Kettle & Crane's risk ratings.
ransomware-as-a-service: A model where one group builds ransomware and rents it to affiliates, who carry out attacks and share each ransom with the developer.
RCS: Rich Communication Services, the modern upgrade to SMS. It adds photos, typing indicators, read receipts, delivery over data or Wi-Fi, verified business messages, and growing end-to-end encryption, which attackers use to slip past carrier SMS filters.
reconnaissance: The first APT stage: learning about the target from its website, staff profiles and job ads to find names, email formats and software in use.
remote support session: A session that hands control of a computer to someone else. Fake help desks in Teams ask victims to start one.
Reply-To: A hidden email field that can send your reply to a different address than the sender shown.
requirements: The questions you need intelligence to answer, set in the first phase of the life cycle, such as Alex's 'Which threats target small online shops like ours?'
reserved: The state of a CVE ID that has been assigned before the flaw's details go public, which gives the maker time to release a fix.
resources/funding: What an actor can spend on an attack (money, people, time, tools) and where that money comes from, such as a government budget or earlier ransoms. It decides how long the attacker keeps trying.
revenge: A motive to hurt someone the attacker believes wronged them, often right after a firing, like the warehouse worker who wiped the address book. Insider is who; revenge is why.
risk: The chance of harm when a threat meets a vulnerability, together with how bad that harm would be. Without both a threat and a weakness, there is no risk.
risk matrix: A grid with likelihood along one side and impact along the other. Threats in the high-high corner are handled first.
risk score: Likelihood × impact, each rated 1 to 5. The shop plugin threat scores 5 × 4 = 20 out of 25.

S

S/MIME: A standard for signed and encrypted email. It strengthens genuine mail but doesn't tell receivers to reject forgeries.
Scope (S): A CVSS 3.1 metric. S:C (Changed) means the attack can reach beyond the flawed part, and S:U (Unchanged) means it can't.
severity rating: The word form of a CVSS score: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0).
short link: A shortened web address that hides where it really leads. It is common in smishing texts.
smishing: Phishing by text message, such as a fake 'USPS: your package is on hold' text with a payment link.
SMS: Short Message Service, the original plain-text phone messaging (up to 160 characters) carried by the mobile carrier. It is not end-to-end encrypted, senders are easy to fake, and company filters never see it.
social engineering: Tricking people into acting against their own interest, for example with an urgent fake invoice.
sophistication/capability: How skilled an actor is. Low means running others' tools, medium means adapting tools and running convincing scams, and high means custom malware and zero-days. It is judged separately from resources.
spear phishing: Phishing aimed at one chosen person, using details about them.
SPF: Sender Policy Framework: an email standard that lists the servers allowed to send for a domain. It checks only the envelope sender, so on its own it can pass a forged From address.
spoofing: Forging the sender address so an email seems to come from someone trusted, using the exact real address. The basic email standard doesn't check senders, so DMARC is needed to stop it.
SQL: Structured Query Language, used to query databases. SQL typed into a search box is the classic injection example.
state-sponsored: A threat actor that works for or is paid by a national government. It has the most skill, money and patience, and aims at secrets, infrastructure and sometimes money (such as North Korea's Bybit theft).
STIX: Structured Threat Information Expression: an open OASIS standard for writing threat intelligence as machine-readable data, such as an indicator for the fake site `kettleandcrane-billing.com`. STIX data is usually sent between systems using TAXII, so tools like firewalls can act on it automatically.
stix2: A free Python library for creating and reading STIX 2.1 objects, such as an indicator describing a malicious domain. Defenders use it to produce threat intelligence in a standard format that other tools can share and act on.

T

TAXII: Trusted Automated Exchange of Intelligence Information: a standard way to send STIX data between computers. Feeds deliver 'STIX over TAXII'.
terrorist: A threat actor that attacks to cause fear, harm or disruption for a political, religious or ideological cause, often aiming at critical infrastructure. It differs from a hacktivist by seeking fear and harm.
threat: Anything that could cause harm, such as a criminal gang, a flood or a tired employee who clicks the wrong link.
threat actor: A person or group that could cause harm. The exam names eight kinds, from organized crime to accidental actors.
threat actor profile: A summary of a likely attacker's actor type, motive and three attributes, used to pick matching defenses. Alex profiled a ransomware gang, a departing employee and a bored teenager.
threat feed: A constantly updating stream of threat intelligence, mostly indicators of compromise, that tools such as firewalls can act on. A good feed is timely, accurate and relevant.
threat intelligence: Information about threats that has been collected and checked so defenders can act on it.
threat intelligence life cycle: The repeating six-phase process for intelligence: planning and direction, collection, processing (cleaning and formatting), analysis (finding meaning), dissemination and feedback.
threat source: Where a threat comes from: the actor or group behind it, such as an APT.
threat vector: The path or method an attacker uses to reach a target, such as an email with a bad link or a USB stick in the parking lot. Name the vector by the channel used.
TOC/TOU: Time-of-check to time-of-use: the timing gap between a program checking something and acting on it, which a race condition exploits.
trade secret: Business knowledge that is valuable because rivals don't know it, such as Kettle & Crane's roast profiles.
two-step verification: Chat apps' name for multifactor login: a PIN or code needed on top of the phone number.

U

unskilled attacker: An attacker who uses tools and scripts written by others without understanding them, noisily trying easy targets like default passwords. Basic hygiene stops them.
USB: Universal Serial Bus. A USB drive can be used by insiders to copy data, or left in a parking lot as a threat vector.
User Interaction (UI): A CVSS metric for whether a victim must do something, like clicking. UI:N means none, and UI:R means required.

V

vector string: A short code that records the metric answers behind a CVSS score, such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H for Log4j.
Volt Typhoon: A China-backed state-sponsored group that US agencies warned in 2024 had hidden inside US power, water, communications and transport networks for years.
vulnerability: A weakness that a threat could use, such as an old shop plugin or the password coffee123. If you can patch or reconfigure it, it is a vulnerability.
vulnerability types: Broad kinds of weakness that tell you who fixes them: software flaws, misconfigurations, missing patches, end-of-life products, weak or default credentials, hardware and firmware, and human and process.

W

weak or default credentials: A vulnerability type: passwords that are easy to guess or were never changed, like the camera still using 'admin'.
white hat: An authorized hacker with written permission who reports flaws to the owner under agreed rules, such as a penetration tester.
wiper: Malware that destroys files so they can't be recovered, sometimes behind a fake ransom note. It points to a fear/chaos motive.

Z

zero-day: A flaw that attackers use before the maker knows about it, so no patch exists yet. It is a clue for high sophistication.