Physical and Wireless Vectors, and Vulnerabilities

Glossary

203 terms from Physical and Wireless Vectors, and Vulnerabilities, in plain words, each with the chapter that teaches it.

Search the glossary

#

3DES (Triple DES): An older encryption algorithm that runs DES three times. It is slow and uses small blocks, and NIST stopped allowing it for encryption after 2023, so AES should be used instead.

A

Access pass: Anything a person shows or taps to get through a door, such as a staff badge, visitor pass or phone credential. Passes can be switched off, unlike keys, but they can still be cloned, lost, shared or left active, like the 47 extra badges Alex disabled.
Access vestibule: A small room with two doors where only one door can be open at a time, so a person following someone else in gets caught between them. It stops tailgating, but it fails if a door is propped open or nobody watches it.
Active Directory: Microsoft's directory service that keeps track of Windows user and computer accounts. Alex can ask it which accounts haven't logged in for a while.
AES (Advanced Encryption Standard): The current standard symmetric encryption algorithm and the replacement for DES, 3DES and RC4. 128-bit keys are enough today, and 256-bit keys give extra margin.
API key: A long code that lets one program use another program's service, such as the courier service's API key. It is a secret, so it should never be hardcoded, and it should be rotated.
Atomic operation: A single operation that can't be split up or interrupted. Doing the check and the use in one atomic step closes a race condition.
Attack surface: All the places an attacker could try to get in: every device, service, account and door. Security work tries to shrink it, for example by closing ports that aren't needed.
awk: A Linux text-processing tool. The lab uses it to pick out only the addresses of hosts that Nmap reported as up.

B

Backport: Copying a security fix into an older version of a program instead of moving to a newer version. On Ubuntu, only the package revision changes (OpenSSL 3.0.13-0ubuntu3.16), so you should check the package version to judge whether a system is patched.
Behavior-based detection: Security tools that look for unusual activity, such as a web server suddenly starting a command shell, instead of known signatures. That lets them catch attacks nobody has seen before, such as zero-days.
BLE (Bluetooth Low Energy): A version of Bluetooth that uses very little power. Trackers, smart locks and sensors use it.
BlueBorne: A set of flaws in Bluetooth software, found in 2017, that let an attacker get into a device without pairing. Unpatched phones and laptops with Bluetooth switched on were at risk.
Bluebugging: A Bluetooth attack in which the attacker takes control of a device, making calls, sending messages or running commands. Memory aid: 'bug' takes control.
Bluejacking: Pushing unwanted messages to a nearby phone over Bluetooth. It is mostly an annoyance. Memory aid: 'jack' sends.
Bluesnarfing: Stealing data such as contacts, messages or files from a device over Bluetooth. Memory aid: 'snarf' takes data.
Bluetooth: A short-range radio standard in the 2.4 GHz band that links devices such as headsets and label printers, usually up to about 10 m. Attackers must be in the same room or next door.
Brute force: Breaking encryption by trying every possible key. DES's 56-bit key has been crackable this way since the 1990s.
Bumping: Beating a pin tumbler lock by striking a specially cut 'bump key' so all the pins jump at once. The defense is a bump-resistant lock.

C

Certificate: A digital document that proves a server's identity for TLS. Expired or self-signed certificates teach users to click past warnings, which counts as poor key management.
Cipher suite: The set of algorithms a TLS connection uses. Servers should switch off weak ones.
CISA (Cybersecurity and Infrastructure Security Agency): The US government agency that warns about attacks, such as the 2023 takeovers of PLCs at water utilities. It also runs the Known Exploited Vulnerabilities catalog.
Collision: Two different inputs that produce the same hash. If collisions are easy to make, as with MD5 and SHA-1, the hash is broken.
Compensating control: A different control that lowers the risk when the normal fix isn't possible. An example is isolating an unsupported or obsolete system that can't be patched.
Container: An app that shares the host's operating system kernel instead of having a full VM of its own. Container escape, where code breaks out to the host, is the container version of VM escape.
Credential: Anything that proves an identity: a user name and password, a key, a token or a certificate. A working credential lets an attacker log in looking like a normal user.
Cryptographic vulnerability: Any way encryption, hashing or certificates are weaker than they look: broken algorithms, short keys, old protocols, implementation bugs or poor key management. Weak cryptography keeps working without warning anyone.
CVE (Common Vulnerabilities and Exposures): The public ID given to a known flaw. For example, the XZ backdoor is CVE-2024-3094 and Log4Shell is CVE-2021-44228.
CWE (Common Weakness Enumeration): MITRE's public list of types of software weakness. For example, TOCTOU is CWE-367 and hardcoded credentials are CWE-798.

D

Defense in depth: Using several layers of control so that one unknown flaw doesn't open everything. It is a key defense against zero-days.
DES (Data Encryption Standard): An old encryption algorithm with a 56-bit key that has been breakable by brute force since the 1990s. Use AES instead.
detect-secrets: A free tool from Yelp that scans code for secrets such as passwords. Its detect-secrets-hook command flagged the hardcoded database password in shop_db.py before it was committed.
Digital signature: A cryptographic check that proves an update really came from the vendor and wasn't changed. It stops hijacked and fake updates, but not a compromised vendor like SolarWinds.
Discoverable mode: A Bluetooth setting in which a device announces itself so new devices can find it. Switch it off after pairing, as Alex did with the label printer.
DNS (Domain Name System): The service that turns names into addresses, on port 53. Encrypted versions are DNS over TLS (port 853) and DNS over HTTPS (port 443).
Downgrade attack: An attacker in the middle tampers with the connection setup so both sides agree on the weakest protocol version they both still accept, such as TLS 1.0. The surest fix is a server that doesn't accept old versions at all.
dpkg: The Debian and Ubuntu package tool. `dpkg -l` shows an installed package with its full revision, which is the version to compare against security notices.

E

Eavesdropping: Listening to radio signals that aren't encrypted, such as an old wireless keyboard or an NFC exchange. It hurts confidentiality.
Elliptic-curve cryptography: A family of asymmetric algorithms that a large enough quantum computer could break. NIST plans to deprecate it after 2030 and disallow it after 2035.
End of life (EOL): The date a product stops being sold or supported. After end of support, no fixes of any kind come, as with Windows Server 2016 after January 12, 2027.
Environment variable: A named value the system gives a program when it starts. The fixed shop_db.py reads the password from SHOP_DB_PASSWORD instead of hardcoding it.
EOSL (end of service life): The date all vendor service for a product stops.
EternalBlue: A 2017 flaw in Windows' SMB version 1 service that let attackers run code over the network with no login. Microsoft fixed it with MS17-010 in March 2017, but WannaCry used it two months later to spread through unpatched machines.
Exception: What a program raises when something goes wrong, such as a database that won't answer. Exception handling decides what happens next. It is unsafe when it shows too much detail or fails open.
Exploit: The code or method that uses a vulnerability.
Extended security updates: A paid, time-limited service that keeps security fixes coming after a product's normal support ends. It buys time to move, but it isn't a long-term plan.

F

Fail closed: The safe rule that if a security check can't finish, the answer is 'no'.
Fail open: When a security check crashes and the program carries on as if it had passed. In errors.py, everyone got the CAFE50 discount because the error was swallowed.
FIPS (Federal Information Processing Standards): US government standards published by NIST. FIPS 203, 204 and 205 (August 2024) are the first post-quantum cryptography standards.
Firmware: The software inside devices such as routers, printers, cameras and Bluetooth chips. People often forget to patch it, because it doesn't update with the operating system.
FTP (File Transfer Protocol): An old file transfer service on port 21 that sends passwords and files as plain text. Replace it with SFTP or FTPS.
FTPS: FTP wrapped in TLS encryption, on ports 989 and 990. Don't confuse it with SFTP.

G

grep: A Linux tool that searches text. In the lab, `grep -vxFf inventory.txt found.txt` lists the scanned addresses missing from the inventory.

H

Hardcoded secret: A password, key or token written straight into source code, like DB_PASSWORD in shop_db.py. Everyone with the code, and its history, has the secret, so the first fix is to rotate it.
Hardening: Making a system safer by switching off default accounts, old protocols and unused services, and applying secure settings from a published baseline.
Hardware security module (HSM): A tamper-resistant device that stores keys and does the cryptography without ever releasing the keys.
Heartbleed: A 2014 bug in OpenSSL that let anyone read chunks of a server's memory, including private keys. It is an implementation bug: TLS itself was fine.
HMI (human-machine interface): The part of an OT system a person looks at and touches, such as the touchscreen beside Kettle & Crane's roaster.
Host addresses (127.0.0.1, 0.0.0.0): Special addresses used when a service listens. 0.0.0.0, as in `ss` output such as 0.0.0.0:23, means 'every network address the machine has', so the whole network can reach the service; 127.0.0.1 (loopback) means only the machine itself can reach it.
Host and guest: In virtualization, the host is the physical computer and the guests are the VMs running on it.
HTTP (Hypertext Transfer Protocol): The web protocol. Plain HTTP on port 80 sends pages and logins as readable text, while HTTPS on port 443 encrypts them, which is why Alex moved the camera's setup page to HTTPS.
Hypervisor: The program that creates and runs VMs. Type 1 runs directly on the hardware, and Type 2 runs as an app on a normal operating system. Whoever controls it controls every VM.

I

ICS (industrial control system): Many PLCs and HMIs working together, for example across a factory or a water plant.
IMAP (Internet Message Access Protocol): A protocol for reading mail on the server, on port 143. IMAPS is the encrypted version, on port 993.
Implementation bug: A flaw in the code that runs a strong algorithm, as opposed to a weakness in the algorithm itself. Heartbleed is an example.
Information technology (IT): The computers and systems that move data, such as laptops, email and databases. In IT, confidentiality usually comes first, while OT puts safety and availability first.
Injection (RF): Sending fake radio signals, such as typed keystrokes accepted by cheap wireless keyboards in the 2016 MouseJack research.
Insecure defaults: Settings that ship switched on and weaker than they should be, such as guest accounts, old protocols or open remote access.
Inventory: A list of every device, VM or piece of software a company owns and manages. If you compare it with a network scan, anything that appears in the scan but not in the list is unmanaged or rogue.
IoT (Internet of Things): Small connected gadgets such as smart cameras or printers. The difference from OT is that OT runs a physical process.
Isolation (virtualization): The promise that each VM is sealed off from the others as if they were separate machines. Virtualization vulnerabilities are ways this promise breaks.

J

Jamming: Flooding a radio frequency with noise so real signals can't get through, for example so a wireless alarm sensor can't report an opened door. It hurts availability.

K

Kernel: The core of an operating system. A flaw there sits underneath every program, and containers share the host's kernel.
KEV (Known Exploited Vulnerabilities) catalog: CISA's public list of flaws that attackers are already using. It is a good way to decide which patch goes first.
Key length: The size of a key in bits, which sets how many guesses an attacker needs. For RSA, 2,048 bits is today's minimum and 1,024 is too short. For AES, 128 bits is enough.
Key management: How keys are stored, shared, changed and created. Most real cryptographic failures happen here: hardcoded keys, keys copied to many servers, keys never changed, or weak random numbers.
Key vault: A cloud service that does the same job as a hardware security module: it stores keys securely and does the cryptography with them, so the keys aren't handed out.
KNOB: A 2019 Bluetooth attack that forces two devices to agree on a very short encryption key and then guesses it.

L

Latch slipping: Opening a door by pushing a thin card or tool past the latch. A deadbolt and a plate over the gap stop it.
LDAP (Lightweight Directory Access Protocol): A protocol for directory lookups, on port 389. LDAPS is the encrypted version, on port 636.
Least privilege: Giving programs and users only the rights they need, so a flaw gives an attacker as little as possible.
Lock (resource): Holding a resource from before the check until after the use, so nothing else can change it in between. It is one fix for race conditions.
Lock and key: The oldest physical access control and a threat vector. Keys can be picked, bumped, copied or never returned, and they can't be switched off, so the fix is rekeying or restricted keys.
Lock picking: Opening a lock without its key by using thin tools to push the pins up one at a time. High-security locks with extra pins and side bars resist it.
Log4Shell: A December 2021 zero-day in Log4j, a Java logging library: one line of text written to a log could make a server run an attacker's code. It also showed that many companies didn't know where Log4j was used.
LTS (long-term support): A product release, such as Ubuntu 20.04 LTS, that gets fixes for a longer published period.

M

Maintenance window: A planned time when systems can be updated or restarted without disturbing the business.
Malicious update: Harmful code delivered through the trusted update path, for example via a compromised vendor, a hijacked download server, a taken-over project or a fake update pop-up. The harm comes because the system updated, as with the 4.2.1 shipping-label plug-in.
Managed device: A device enrolled in tools that set and check its configuration, such as a laptop joined to the company directory with an endpoint agent and automatic updates. It is the opposite of an unmanaged system.
Management console: The admin interface for a hypervisor. Whoever controls it controls every VM, so protect it with MFA and keep it on a separate network.
Master key: A key that opens many locks, so losing one exposes the whole building.
MD5 (Message Digest 5): An old hash in which collisions are easy to make. Use SHA-256 or SHA-3 instead.
MDM (mobile device management): A service that pushes settings to phones and tablets and checks them. A device enrolled in it counts as managed.
MFA (multifactor authentication): Requiring more than one proof of identity, so a leaked password alone isn't enough. Alex requires it for vendor VPN access; the Colonial Pipeline attackers got in through an old VPN account that didn't have it.
Modbus: An OT protocol from 1979 with no login and no encryption. Any device that can reach a PLC on TCP port 502 can change its settings.
MouseJack: 2016 research showing that some cheap wireless mice and keyboards accepted keystrokes injected from an attacker's radio.

N

n-day: A known flaw that has a fix but is still dangerous on systems that haven't installed it.
NAC (network access control): Checking each device before it's allowed on the network. Unknown devices can be sent to a separate guest segment automatically.
Network namespace: A separate copy of a computer's network that acts like a separate computer. The labs use `ip netns exec` to run commands as the scanner or the camera.
NFC (near-field communication): Radio that works only at about 4 cm, on 13.56 MHz, and is used for tap-to-pay and tapping cards. Attacks need the attacker within touching distance.
NFC tag: A small sticker that does something, such as opening a web page, when a phone taps it. An attacker can stick a malicious tag over a real one, like the fake sticker on Kettle & Crane's market stall.
NIST (National Institute of Standards and Technology): The US agency that publishes security guides and standards, such as SP 800-82 for OT and the post-quantum FIPS.
Nmap: A free network scanner that finds which hosts are up (-sn) and which ports are open. Its SERVICE column is only a guess based on the port number.

O

O_NOFOLLOW: An option for opening a file that refuses symbolic links in the same step. It closes the TOCTOU gap in toctou_fixed.py.
Obsolete system: Old technology that has been replaced and can't run current protections, such as a printer that only speaks SMB version 1. It can be obsolete and still supported.
One-way data link: A connection that lets data flow in only one direction, so the office can receive the roaster's production data but nothing can be sent back to the OT network.
Open port: A port with a service listening behind it. Each one is a door in the attack surface, so it should have a reason to be open.
OpenSSL: A widely used encryption library and toolkit. Its s_client and s_server commands are a test client and server, and it was the software affected by Heartbleed.
OS (operating system): The software that runs the computer, such as Windows, macOS, Linux, Android or iOS. Every program sits on top of it.
OS-based vulnerability: A weakness in the operating system itself, such as kernel flaws, insecure defaults, weak permissions or missing OS updates, rather than in one application.
OT (operational technology): Hardware and software that watches or controls physical things, such as Kettle & Crane's roaster. In OT, safety and availability come before confidentiality.

P

Pairing: Two Bluetooth devices agreeing on a shared key and remembering each other before they talk. Pairing that shows a code on both screens is safer.
Physical-based vector: A way in through the building itself: locks and keys, access vestibules and access passes. Once inside, an attacker can plug into the network, read papers or carry off a laptop.
PIN (personal identification number): A code entered along with a badge or card, so a stolen card alone isn't enough.
Pin tumbler lock: The most common door lock: spring-loaded pins must be pushed to the right heights by the correct key before it turns.
pkexec: A Linux tool installed by default on most systems. The PwnKit flaw in it let any local user become root.
PLC (programmable logic controller): A small computer that runs a machine, like the one that reads the roaster's sensors and switches its burner and motor. It obeys any command that reaches it, so you must guard the path to it.
POP3 (Post Office Protocol 3): A protocol for fetching mail, on port 110. POP3S is the encrypted version, on port 995.
Port: A number from 0 to 65,535 that tells a computer which program should get incoming network data, for example 22 for SSH or 443 for HTTPS.
Post-quantum cryptography: Algorithms designed to resist large quantum computers, which could break RSA and elliptic-curve cryptography. NIST published the first standards in August 2024.
PowerShell: Microsoft's command shell for Windows. Alex uses it to list inactive accounts.
Privilege escalation: A flaw that lets a normal user become an administrator or root, as PwnKit did on Linux.
Proximity card: A 125 kHz badge that sends the same fixed number with no encryption. Anyone with a hidden reader nearby can read and copy it.
PwnKit: A flaw in Linux's pkexec that let any local user become root. Because it needs an account on the machine first, it is privilege escalation, not a network attack.

Q

QEMU: A widely used hypervisor component. Its virtual floppy controller held the VENOM escape flaw.

R

Race condition: A flaw where a program's result depends on the timing of two things happening at once, so an attacker who changes the timing changes the result. An example is two customers using a discount code's last use at the same moment.
RC4 (Rivest Cipher 4): An old encryption algorithm with biased output, banned from secure web connections since 2015. Use AES instead.
RDP (Remote Desktop Protocol): Windows remote desktop, on port 3389. It is attacked when exposed, so put it behind a VPN with multifactor login.
Rekey: Changing a lock's pins so old keys no longer work. It is the only fix when a key is lost or kept.
Relay attack: Two attackers pass a card's or car key's signal between them, so a terminal or car thinks the real card or key is close by.
Replay attack: Recording a radio signal and playing it back later, like recording the fixed-code loading-bay remote. Rolling codes stop simple replay.
Resource reuse: When memory or disk from a deleted VM goes to another VM, possibly another tenant, without being wiped, so leftover data can be read. Side channels are a related form.
Restricted key: A key that a locksmith will copy only when shown a signed card, which stops people making copies from a photo or a quick borrow.
RF (radio frequency): The general name for radio waves used to send data. On the exam it usually means links other than Bluetooth and NFC, such as Wi-Fi, remotes and wireless keyboards, which can reach the parking lot.
RFC (Request for Comments): One of the Internet Engineering Task Force's numbered standards documents. RFC 8996 deprecated TLS 1.0 and 1.1.
RFID (radio-frequency identification): Radio technology used by badges to talk to door readers. Both proximity cards and smart cards are RFID.
RFID cloning: Copying a badge's data onto another card so the copy opens the same doors.
Rogue device: A device that isn't allowed on the network at all, such as an attacker's hidden access point. An unmanaged device may be allowed but isn't under IT's control.
Rolling code: A remote that changes its code each time it is used, which stops simple replay attacks.
Root: The Linux administrator account.
Rotate: Replacing a secret or password with a new one. It is the first step after a secret leaks or is hardcoded, and service passwords should be rotated on a schedule.
RSA: An asymmetric algorithm named after its inventors. Keys must be at least 2,048 bits today, and a future quantum computer could break it.
RTSP (Real Time Streaming Protocol): The protocol for a camera's video stream, usually on port 554.

S

SCADA (supervisory control and data acquisition): An industrial control system spread over a wide area and watched from a central control room.
Search-ADAccount: A PowerShell command that, with -AccountInactive and -TimeSpan, lists Active Directory accounts that haven't logged in for a given period, such as 90 days.
Secret: Anything that proves who a program is: a password, an API key, a private key or a token.
Secrets manager: A service that stores secrets encrypted, gives them only to the right programs and can rotate them on a schedule. It is safer than an environment variable or the code itself.
Segmentation: Splitting a network into separate parts so one part can't reach another, like keeping the roaster network away from the office. It is the main fix for OT and for systems that can't be patched.
Service: A program that waits for network connections on a port, such as a web server or remote login. Services nobody needs should be disabled.
Service account: An account that programs use to log in to other programs, like svc-backup. Its password often never changes, so it should be rotated and stored in a vault.
Setpoint: The value a controller tries to reach, such as a target temperature. An attacker may change it on a PLC.
SFTP: File transfer over SSH on port 22. It is the safe replacement for FTP and is different from FTPS.
SHA (Secure Hash Algorithm): A family of hashes. SHA-1 is broken by practical collisions and is being retired, while SHA-256 and SHA-3 are current choices.
Shadow IT: Technology a department buys or runs without IT's approval. The term is about how the technology was acquired, while 'unmanaged' describes its state.
Side channel: Learning another VM's secrets by measuring tiny timing differences in a shared processor, as the Spectre and Meltdown flaws showed.
Signal-based vector: A way in that travels through the air by radio: NFC (a touch away), Bluetooth (across a room) and other RF (as far as the parking lot). The distance tells you where the attacker must stand.
Skimming: Reading a payment or badge card with a hidden reader held close by, usually in order to clone it.
Smart card: A 13.56 MHz card with a chip that can prove itself with a cryptographic challenge, so a copied number alone isn't enough.
SMB (Server Message Block): Windows file sharing, on port 445. Version 1 is obsolete and was attacked by EternalBlue and WannaCry, so keep it switched off and never expose SMB to the internet.
SMTP (Simple Mail Transfer Protocol): The protocol for sending mail, on port 25. Encrypted options are SMTPS on port 465, or mail submission with STARTTLS on port 587.
Snapshot: A saved copy of a VM at one moment. Restoring an old one brings back unpatched software and old passwords, and a VM image (template) can carry secrets or weak settings into every VM built from it.
SNMP (Simple Network Management Protocol): A protocol for managing network devices, on UDP port 161. Versions 1 and 2c use a plain-text 'community string' as the password. Use SNMPv3.
Software-defined radio (SDR): A cheap radio receiver controlled by a computer program that can record and replay many signals.
SolarWinds Orion: Network monitoring software whose vendor build was backdoored in 2020, so up to about 18,000 customers installed a signed malicious update. The 3CX phone app was hit the same way in 2023.
Spectre and Meltdown: Processor flaws made public in 2018. They showed that side-channel attacks on a shared processor can leak secrets on real hardware.
ss: A Linux command that lists a machine's open sockets. `-tln` shows listening TCP ports as numbers, and adding `p` shows which program owns each one.
SSH (Secure Shell): Encrypted remote login on port 22. It is the safe replacement for Telnet.
SSL (Secure Sockets Layer): The old predecessor of TLS, with known attacks. It shouldn't be used.
ssl-enum-ciphers: An Nmap script that connects many times to report which TLS versions and ciphers a server accepts. It is used to find old versions such as TLS 1.0.
Stack trace: The full technical error a program produces. Showing it to users leaks details such as database host names, which is a form of unsafe exception handling (CWE-209).
Staged updates: Installing updates on a few test systems first and watching them before rolling out to the rest.
Stale credentials: Logins for accounts nobody uses any more that still work, such as the account of jlee, who left in June. The first fix is to disable them.
sudo: A Linux command that runs another command with root (administrator) rights. The labs need it.
Supply chain-based vector: An attack that gets in through a vendor or provider. If a question asks how the attacker got in, the answer is supply chain. If it asks about the danger of trusting updates, the answer is malicious update.
Support life cycle: The stages a vendor publishes for a product: general availability, mainstream support (fixes and features), extended support (security fixes only) and end of support.
Symbolic link: A file that points to another file. In toctou.py, the attacker swapped the order file for a symbolic link to secret.txt.

T

Tailgating: Following an authorized person through a door before it closes. Access vestibules are the control built to stop it.
TCP (Transmission Control Protocol): The network protocol most services use. It sets up a connection before sending data.
Telnet: An old remote login service on port 23 that sends passwords as plain text. Alex switched it off on the camera. Use SSH instead.
Tenant: Each customer sharing a cloud provider's hardware.
Thread: A second line of work running at the same time inside a program. toctou.py runs its attacker as a thread.
Threat vector: The path an attacker uses to reach a target, such as a PLC network, a door or a radio signal. The vulnerability is the weak spot at the end of that path.
TLS (Transport Layer Security): The protocol that encrypts connections such as HTTPS. Use TLS 1.2 or 1.3. Versions 1.0 and 1.1 are deprecated, and servers should refuse them.
TOCTOU (time-of-check to time-of-use): A race condition where something changes between the moment a program checks it (TOC) and the moment it uses it (TOU), so the check is out of date. Make check and use one atomic step to fix it.
Trojan: A malware type: harmful code posing as legitimate software.

U

UDP (User Datagram Protocol): A network protocol that just sends data without setting up a connection first. SNMP uses it.
Unmanaged credentials: Credentials nobody controls: default passwords never changed, shared logins, or API keys and service passwords that are never rotated.
Unmanaged system: A device outside IT's control: not in the inventory, with no agent, patching or monitoring, like the camera the lab found at 192.168.50.13.
Unpatched system: A system missing a fix that already exists. It is the most common vulnerability, and you should patch flaws on the KEV list first.
Unsupported product: A product whose maker no longer provides fixes, so new flaws stay open forever, as with Windows Server 2016 after January 12, 2027.

V

VENOM: A 2015 VM escape flaw in QEMU's virtual floppy disk controller that let a guest run code on the host.
Virtual device: The software copy of hardware, such as a network card or disk controller, that a hypervisor gives a VM. Bugs in virtual devices can allow VM escape.
Virtual patch: Blocking an attack pattern, for example with a web application firewall, before a real patch exists.
Virtualization: Running several computers in software on one physical computer. Its vulnerabilities include VM escape, resource reuse, VM sprawl, risky snapshots and an exposed management console.
VM (virtual machine): A computer that runs in software on a physical host, like Kettle & Crane's order server and accounting server.
VM escape: An attack where code inside a guest VM breaks out to the hypervisor or host and can then reach every other VM on that host. It is the worst virtualization flaw.
VM sprawl: The uncontrolled growth of VMs nobody tracks, like the forgotten test web shop that shared the real shop's admin password. Prevent it with an inventory that gives each VM an owner and an end date.
VPN (virtual private network): An encrypted connection into the company network, used for remote and vendor access. It should require MFA, and old VPN accounts are a common stale credential.
Vulnerability: A weakness an attacker can use, such as a missing patch, a default password or an open door.

W

WAF (web application firewall): A firewall that inspects web traffic and can block attack patterns, such as the Log4Shell text, before a patch exists.
WannaCry: Ransomware that in 2017 spread through hundreds of thousands of unpatched computers using the EternalBlue flaw in SMB version 1.

X

XZ Utils: A Linux compression library in which a trusted maintainer hid a backdoor in versions 5.6.0 and 5.6.1 in 2024. Ubuntu's fix package '5.6.1+really5.4.5' is a rollback dressed as an update.

Z

Zero-day: A flaw the vendor doesn't know about or hasn't fixed yet, so no patch exists. Defend with layers, segmentation, least privilege, behavior-based detection and vendor workarounds, then patch fast once a fix appears.