Modern Vulnerabilities, Malware and Physical Attacks

Glossary

238 terms from Modern Vulnerabilities, Malware and Physical Attacks, in plain words, each with the chapter that teaches it.

Search the glossary

#

802.1X: A network access control standard where a device or user has to prove who it is before it gets onto the network, instead of being trusted because of its MAC address. WPA2 and WPA3-Enterprise use it so that each staff member signs in with their own account.

A

Abandoned package: A package in a public registry that people still download but nobody maintains or fixes, so its flaws stay in place.
Acceptable use policy: A company document that sets out which tools and services staff may use and how. Alex adds rules on unapproved services to it to cut down shadow IT.
Access control vestibule: An entry with two doors where only one can be open at a time, so only one person gets through per badge swipe. A turnstile does the same job, and both are the main controls against tailgating.
Access point (AP): The box that adds Wi-Fi to a wired network. If an unapproved one is plugged into an office socket, it becomes a rogue access point.
ACL (access control list): The older way of setting permissions on each object in cloud storage. Two of the four Block Public Access switches block or ignore public ACLs.
Adware: Software that shows unwanted ads, such as pop-ups, new tabs or a changed home page or search engine. It usually comes bundled with free software, like the PDF converter that brought the 'DealFinder' toolbar to Jo's browser.
Allow listing: A control that lets a computer run only programs on an approved list, matched by publisher signature, hash or path. Anything else is refused, so a brand-new trojan cannot start even if antivirus does not recognize it.
Amazon S3 (Simple Storage Service): Amazon's object storage service, which keeps files (objects) in buckets. Whether a stranger can read a bucket depends on its policy and its Block Public Access settings.
Anti-passback: A badge system feature that expects each badge to alternate between entry and exit. If a badge is used to leave an area it never entered, the system raises an error, which suggests the owner came in behind someone else.
Antivirus: Software that blocks files it recognizes as bad, mostly by signature. A brand-new trojan, a polymorphic virus, fileless malware or a hardware keylogger can all get past it.
API key (application programming interface key): A secret that lets a program use a service, such as Kettle & Crane's shop key. If one leaks, it has to be revoked and replaced, because Git history keeps old copies.
App permissions: The access a phone app or browser extension is granted, such as contacts, microphone, location or accessibility. An app that asks for more than it needs is a way for data to leave, and broad permissions are a sign of spyware.
arn (Amazon Resource Name): AWS's format for naming a resource. In a bucket policy, arn:aws:s3:::kc-wholesale-exports/* means every object in that bucket.
Asset inventory: A list of every approved device with its MAC address. Alex compares it with the DHCP leases to spot devices nobody approved.
ATM (automated teller machine): A cash machine. Like gas pumps and shop payment terminals, ATMs are common targets for skimmers.
Attack surface: Every place an attacker can try to get in, including open ports, apps, accounts and devices. Each rogue device, shadow IT service, radio or chatbot adds to it.
AWS (Amazon Web Services): Amazon's cloud platform, which includes S3. Since April 2023, every new bucket on AWS has Block Public Access turned on by default.
Azure Blob Storage: Microsoft's object storage service, which keeps objects in containers. It has its own anonymous access setting, similar to Block Public Access.

B

Backdoor: A hidden way back in for an attacker. Trojans often install one, and the xz utils attack hid one in a trusted package.
Badge cloning: Copying someone's access badge with a hidden reader. The copy makes its own swipe, so the log shows the owner entering at a time they were somewhere else.
Base64: An encoding that turns any data into letters, digits, + and /. PowerShell's -EncodedCommand takes base64, and attackers use it to hide commands; decoding it (for example with base64 -d) shows the real text.
Beaconing: Malware checking in with the same unknown address at regular intervals, like Priya's laptop contacting one server every five minutes. It is a sign of a trojan or bot talking to a command and control server.
BlackLotus: A UEFI bootkit found in 2023 that got around Secure Boot using flaw CVE-2022-21894. The NSA published a guide to removing it.
BLE (Bluetooth Low Energy): A low-power version of Bluetooth on the 2.4 GHz band, used by phones, wearables, printers and devices like the roastery's shipping scale. How safe it is depends on the pairing method.
Bloatware: Unwanted software the vendor pre-installed on a new device. Unlike adware, which comes bundled with a later download, it is there from the start.
Block Public Access: Four S3 switches that block and ignore public ACLs, refuse new public bucket policies, and limit any existing public policy to the owner's account. With all four on, a bucket cannot be made public.
Boot sector virus: A virus that infects the first part of a disk the computer reads at start-up, so it runs before the operating system.
Bootkit: A rootkit that infects the boot process or the firmware, so it runs before the operating system and survives a reinstall. Removing it means reflashing or replacing the firmware, and Secure Boot is the main defense.
Bot and botnet: Bots are infected computers that take orders from one command and control server; together they form a botnet, often used for DDoS floods or spam. The clue is many hosts beaconing to the same C2 address.
Bucket: A container for objects in cloud object storage, such as kc-wholesale-exports. Its settings decide whether strangers can read what is inside.
Bucket policy: A JSON rule that grants access to a bucket using Effect, Principal, Action and Resource fields. A policy with "Principal": "*" and s3:GetObject lets anyone download every object.

C

C2 (command and control): The attacker's server that malware checks in with and takes orders from.
Card cloning: Copying stolen card data onto a blank card after skimming. Skimming is the theft at the reader; cloning comes afterward.
CASB (cloud access security broker): A tool that sits between users and cloud services and reports which services are in use, which helps find shadow IT.
Chip card and contactless payment: Ways of paying that are much harder to copy than a magnetic stripe. That is why the FBI advises using the chip or tapping to pay.
CISA (Cybersecurity and Infrastructure Security Agency): The US government's cybersecurity agency. Its ransomware guide and checklist say to isolate first, keep systems powered on, and report early.
Code review: Having another person check code changes before they go live. Together with separation of duties, it makes it hard for one insider to plant a logic bomb unseen.
Commit: A saved version of the files in a Git repository. Git keeps every earlier commit, so a key deleted in a later commit can still be read in history.
Common point of purchase: The one place where several fraud victims all used their cards, such as the tasting counter's terminal. Banks use it to find a skimmer.
CompTIA Security+ (SY0-801): A widely recognized entry-level IT security certification exam from CompTIA. Its objectives include explaining types of vulnerabilities and attack surfaces (2.4) and analyzing indicators of malicious activity such as malware and physical attacks (2.5).
Confidentiality, integrity and availability: The three things security protects: keeping data secret, keeping it correct, and keeping systems usable. Malware is defined as software that harms one or more of them.
Cron: The Linux service that runs commands on a schedule; a crontab line lists minute, hour, day of month, month and day of week, where * means 'every'. A logic bomb can hide in a script that a normal-looking cron job runs.
Cryptocurrency: Digital money. Ransomware usually demands payment in it, and cryptojacking malware mines it.
Cryptojacking: Malware that uses the victim's CPU or graphics card to mine cryptocurrency. The clues are constantly high processor use and connections to a mining pool, with no ransom note.
CVE (Common Vulnerabilities and Exposures): A public catalog that gives each known flaw an ID number. For example, CVE-2024-3094 is the xz utils backdoor and CVE-2022-21894 is the Secure Boot flaw BlackLotus used.

D

Data and model poisoning: An OWASP LLM risk where bad data put in during training changes how the model behaves.
Data extortion: A demand for payment backed by stolen data, while the victim's files still work. Ransomware locks files instead, and double extortion does both.
DDoS (distributed denial of service): Flooding a target with traffic from many computers at once, often from a botnet, to knock it offline.
Default password: The factory password a device ships with, often printed in a public manual. Leaving it unchanged, as on the Zigbee hub or the label printer, is a classic misconfiguration.
DHCP (Dynamic Host Configuration Protocol): The service that hands out IP addresses to devices on a network. Its lease list is a record of every device that asked for an address.
DHCP lease: A DHCP server's record of an address it handed out, showing when the lease ends, the MAC address, the IP address and the device's name. Comparing leases with the inventory revealed the rogue 'raspberrypi'.
DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, DHCPACK: The four DHCP messages in a server log: the device asks, the server offers an address, the device requests it, and the server confirms.
Digital Markets Act: An EU law under which, since iOS 17.4 (March 2024), iPhone users in the EU can install apps from alternative app marketplaces.
Digital signature: A mark made with a private key that anyone holding the matching public key can check. Apps trust an identity provider's token because its signature is valid.
DNS (Domain Name System): The system that turns names into addresses. DNS logs show which cloud services office computers visit, which helps find shadow IT.
dnsmasq: A small, lightweight server that hands out IP addresses by DHCP and answers DNS queries on a local network. Its log and lease file record which devices got which addresses, which helps spot rogue devices such as an unapproved Raspberry Pi.
Double extortion: Ransomware that steals data first and then also encrypts it, so the attacker can threaten to publish the data as well as keep the files locked. That is what happened at the roastery on Monday.
Downgrade attack: An attacker actively forcing devices onto a weaker security setting. It is a 2.5 attack, which is different from just finding a weak setting.
Drop box: A tiny attack computer, such as a Raspberry Pi, hidden inside a building. It connects out to the attacker, who then works from home.
Dropper or downloader: A small first-stage program whose only job is to fetch or unpack the real malware.
Dumpster diving: Searching thrown-away paper, drives and media for information. Shredding and secure disposal stop it.

E

ECDH (Elliptic Curve Diffie-Hellman): A key agreement method where each side sends only a public value and works out the shared key privately, so someone who only listens cannot work out the key. BLE Secure Connections uses it.
EICAR test file: A harmless 68-character file that every antivirus treats as a virus, so you can test scanning without real malware. EICAR is the European Institute for Computer Antivirus Research.
Encryption: Scrambling data with a key so only someone with the key can read it. It protects Wi-Fi traffic and lost phones and laptops, and ransomware uses it against victims.
Environment variable: A setting given to a program from outside its code. The fixed shop config reads its API key from one instead of hardcoding it.
Environmental attack: Attacking power, cooling (HVAC) or fire systems to cause an outage. Equipment fails because its environment was cut, not because anyone logged in.
Evil twin: A rogue access point that copies the office network name to lure users onto it. It is a 2.5 attack, which is different from a rogue device that is just found on the network.
Excessive agency: An OWASP LLM risk where the model can take actions (send, delete, pay) that it does not need. Alex removed the chatbot's ability to change addresses for this reason.

F

Federation: Trust set up between identity systems so that one can vouch for users to another. It is taught in detail in a later book.
Fileless malware: Malware that runs in memory using tools already on the computer, such as PowerShell or WMI, instead of saving its own program file. Antivirus file scans often find nothing, as with the invoice that opened a shell from Excel.
Firewall: A device or service that allows or blocks network traffic by rules. Its logs often show beaconing, large uploads and other indicators, and Alex uses it to block bad addresses and ports.
Firmware: Software stored on hardware, such as the motherboard code that starts the computer. Malware hidden there survives reinstalling the operating system.
Forced entry: Getting in by physical force, such as prying a door, breaking glass or cutting a lock. It leaves damage and sets off alarms, like the Sunday-night break-in at the office.
Full disk encryption: Encrypting a laptop's whole drive, so a stolen device exposes far less data.

G

GHz and MHz (gigahertz and megahertz): Units that measure radio frequency. BLE and most Zigbee use 2.4 GHz, while Z-Wave uses 908 MHz.
Git: The tool most code repositories use to keep files with their full history. Because it keeps every version, a secret committed once stays readable.
git log --oneline: A Git command that lists commits, newest first, one line each.
git show: A Git command that shows a file as it was at a given commit; HEAD~1 means 'one commit before the latest'. Alex used it to find the old shop key in history.
GitHub: A website for hosting Git repositories, which can be public. It offers push protection against pushing known kinds of secrets.
Google Cloud Storage: Google's object storage service, which keeps objects in buckets. Its 'public access prevention' setting stops buckets being made public.

H

Handshake: The exchange when a device joins a WPA2 network. Anyone who records it can try to guess the passphrase offline.
Hardcoded secret: A password or key written directly into code, like the API_KEY in config.py. If that code is in a public repository, two weaknesses apply at once.
Hardware security key: A physical device used as a phishing-resistant second factor. A tired user cannot approve it on a fake site.
Hash: A short fingerprint of a file; if one byte changes, the hash changes completely. Comparing a download's hash with the vendor's published hash shows whether it was tampered with, like the mirror's driver file.
Held-open alarm: A door alarm that fires when a door stays open longer than one person needs, which is a sign of tailgating.
Host addresses (127.0.0.1, 0.0.0.0): Special listening addresses: 127.0.0.1 (localhost) means 'this machine only', while 0.0.0.0 means 'every network this machine has'. A service bound to 0.0.0.0 can be reached by anyone who can reach the machine, which can expose an admin page meant only for local use.
HTTP (Hypertext Transfer Protocol): The web's protocol. It reports the result of each request with a status code.
HTTP status codes: Numbers that report the result of a web request: 200 means OK (it worked) and 403 means forbidden (access refused). The anonymous bucket download got 200 while the policy was public and 403 after it was removed.
Hub (gateway): The box that low-power sensors and locks report to, which sits on the normal network. A weak sensor is a nuisance, but a weak hub, like the Zigbee hub with its default password, is a way into the office network.
HVAC (heating, ventilation and air conditioning): A building's heating and cooling systems, which environmental attacks may target.

I

iconv: A Linux tool that converts text between encodings. Here it turns decoded UTF-16LE text into normal UTF-8.
Identity provider (IdP): A service that checks who a user is and vouches for them to other apps by signing tokens. Because every app trusts it, an attacker who takes it over, or steals its signing key or a session, reaches everything.
IEEE (Institute of Electrical and Electronics Engineers): A standards body. Its 802.15.4 radio standard is what Zigbee is built on.
iex (Invoke-Expression): A PowerShell command that runs text as code straight away without saving a file. Paired with irm, it makes a fileless download-and-run.
Improper output handling: An OWASP LLM risk where another system trusts the model's output without checking it, for example running it as a command.
Indicator: A clue that malicious activity has happened, such as a new file extension, beaconing or a held-open alarm. The exam gives you indicators and asks which attack fits.
Insider threat: A person inside the organization who means harm or wants personal gain. Shadow IT usually comes from people seeking convenience instead, and logic bombs are often planted by insiders.
IP address (Internet Protocol address): The network address of a device, such as 192.168.20.144. DHCP hands these out.
irm (Invoke-RestMethod): A PowerShell command that downloads whatever is at a web address.
Isolation: Cutting an infected computer, or for a worm the whole network segment, off from the network so the malware cannot spread, while leaving it powered on to keep evidence in memory. It is the first response to ransomware, worms and fileless malware.

J

Jailbreaking: Removing an iPhone maker's limits to get full control, which also removes the protections that keep apps apart and often stops updates. (For AI, jailbreaking means tricking a model past its rules, which is objective 2.6.)
JSON (JavaScript Object Notation): A text format made of names and values. Bucket policies are written in it.
Just Works: A BLE pairing method for devices with no screen or buttons. It gives no protection against an on-path attacker during pairing.

K

Kernel: The core of the operating system, which controls memory, files and devices. A kernel-mode rootkit can hide files, processes and connections from every program, while a user-mode one only replaces normal programs.
Key revocation: Cancelling a leaked key or password at the service so it stops working, then issuing a new one. Deleting a key from code is not enough, because Git history keeps the old copy.
Keylogger: Malware or a device that records keystrokes to steal passwords and card numbers. A hardware keylogger, like the plug on the shared shipping computer's cable, cannot be found by any software scan.
Known-good media: A trusted, untampered copy of the operating system or a clean disk image used to rebuild a machine. It is the reliable fix for rootkits and RATs, because an infected system cannot be trusted to clean itself.
KRACK (key reinstallation attacks): A 2017 flaw in the WPA2 protocol that tricked devices into reusing keys. It was fixed by patches, not by changing the password.

L

Large language model (LLM): An AI system trained on huge amounts of text that reads plain-language requests and writes replies, like the Kettle & Crane help chatbot. It is an attack surface because it takes input from anyone, is often connected to data, and its output cannot be fully trusted.
LE Legacy Pairing: An older BLE pairing mode built on a short temporary key. Anyone who records the pairing can guess the key and decrypt everything sent after it.
LE Secure Connections: The BLE pairing mode in Bluetooth 4.2 and later. It uses ECDH, so someone who only listens cannot work out the key.
Least privilege: Giving a user, service or AI only the access it needs, so that, for example, a tricked chatbot can only show customers their own orders.
Living off the land: Attacking with the system's own trusted tools, such as PowerShell and WMI, instead of bringing new program files.
Lock picking: Quietly opening a lock without its key, leaving little or no damage. Forced entry, by contrast, leaves damage.
Logic bomb: Malicious code that waits for a trigger, such as a date, an event or a missing action, and then does damage. An example is the contract developer's 'monthly-maintenance' job that wiped the database on the first of each month.
LoRaWAN: A long-range, very slow low-power radio on 902 to 928 MHz, used by meters and remote sensors several kilometers away.
Low-powered communications: Radio systems built to send small amounts of data on very little battery, such as BLE, Zigbee, Z-Wave, LoRaWAN and RFID. They trade security for battery life and price, so weak encryption, weak pairing and missing updates are common.

M

MAC address (media access control address): The hardware address of a network card, whose first half is a vendor prefix (b8:27:eb is Raspberry Pi). MAC addresses can be spoofed, and phones often use randomized private MACs that show no vendor.
MAC address table: A switch's list of which MAC addresses sit on each physical port. It told Alex the rogue device was on port 14, behind the shipping printer.
Macro virus: A virus written as a macro, a small program saved inside an office document; opening the file and clicking 'Enable content' runs it, as with DeliveryNote.xlsm. Office has blocked macros in files from the internet by default since 2022.
Magnetic stripe: The stripe on a payment card that skimmers read. It is much easier to copy than a chip.
Malware: Software or firmware made to do something unauthorized that harms the confidentiality, integrity or availability of a system.
MDM (mobile device management): A service that enforces screen locks, encryption and updates on phones and can wipe a lost one. Alex enrolled the shipping phones in it.
Memory capture: Saving a copy of a computer's memory (and disk) as evidence before it is lost. That is why ransomware and fileless malware responses say to stay powered on and avoid rebooting.
Mesh network: A network where each device passes messages on for its neighbors, so it reaches farther than one radio could. Zigbee and Z-Wave work this way.
Microsoft Entra ID: Microsoft's identity provider service.
Misconfiguration: A setting that is wrong for security even though the system works, such as a default password, too much access or a service listening on every network. If a more specific item fits, such as public object storage, the exam wants that item instead.
moto: A free emulator of Amazon S3 that runs on your own machine. The public-bucket lab uses it.
Multifactor authentication (MFA): Signing in with more than one kind of proof, such as a password plus a code from a phone app. It means a stolen, watched or keylogged password is not enough on its own.

N

Network namespace: An isolated copy of the Linux network stack. The labs use them to build tiny networks that cannot touch a real one.
NFC (near-field communication): A very short-range radio, taught in the previous book as a signal-based attack vector.
NIST (National Institute of Standards and Technology): The US government agency that publishes security standards and definitions. For example, it defines malware as software or firmware made to do something unauthorized that harms the confidentiality, integrity or availability of a system.
nmap: A network scanner. The worm lab uses it to send connection requests to port 445 on many neighbors, the way a scanning worm would.
npm: The public package registry for JavaScript. Anyone can publish to it, including attackers.
NSA (National Security Agency): The US agency that published a guide to removing the BlackLotus bootkit.
Number matching: An MFA setting where a sign-in prompt can only be approved by typing the number shown on the sign-in screen. It stops users from approving prompts without thinking, as Jo did.

O

Object storage: Cloud storage that keeps files (objects) in buckets or containers. Each object has its own web address.
Obscurity: Trying to protect something by hiding it, such as renaming a BLE device or hiding it from scans. A scanner still hears the radio traffic, so it is not a real fix.
Offline backup: A backup the network cannot reach, so ransomware cannot delete it. Alex restored from the Friday offline copy.
Okta: An identity provider company. In October 2023, an attacker got into its support system, where some customer-uploaded files held live session tokens, and used them to take over sessions at some customers.
On-path attacker: An attacker who sits between two devices and can read or change what passes between them, for example during pairing.
Out-of-date software: Software, or a phone model, that no longer gets security updates, so every flaw found after its last update stays open. Rooting a phone or skipping Windows updates leaves devices in this state.
OWASP (Open Worldwide Application Security Project): A nonprofit for software security that publishes Top 10 risk lists.
OWASP Top 10 for LLM Applications: OWASP's list of the main weaknesses of LLM apps (2025 edition), including prompt injection, sensitive information disclosure, excessive agency and system prompt leakage.

P

Pairing: How two wireless devices agree on a key the first time they connect. Weak or old pairing modes let attackers learn the key.
Parent process: The program that started another program. Excel starting PowerShell is a suspicious parent process and is evidence of fileless malware.
Passkey: A sign-in key kept on the user's device. It is phishing-resistant because it cannot be approved on a fake site.
Patch: A software update that fixes a flaw. Missing patches let worms like WannaCry spread, while patched computers stop them.
Payload: The harmful part that malware delivers, such as the ransomware a worm carries or the deletion a logic bomb runs.
Persistence: A way for malware to start again after a reboot or sign-in, such as a registry Run key, a WMI entry or a startup item.
Phishing: Tricking people with fake messages or sign-in pages into giving up credentials or running malware. It is a common way into an identity provider and a common start for ransomware.
Piggybacking: Following someone through a secured door with their knowing consent, for example being let in by a person who said they left their badge in the van.
PIN (personal identification number): A short secret number for cards and devices. Shoulder surfers and skimmer cameras target it.
Polymorphic virus: A virus that changes its own code each time it copies itself, so each copy has a new hash and signatures miss it.
Port: A number that picks out one network service on a machine, such as 445 for SMB.
PowerShell: The scripting shell built into Windows and a favorite tool of fileless malware. The -NoProfile and -WindowStyle Hidden options skip user settings and hide the window.
PowerShell -EncodedCommand: A PowerShell option that takes a command as base64 of UTF-16LE text. Attackers use it to hide what they run.
PowerShell script block logging: A Windows feature that records the text of every PowerShell script that runs as event ID 4104, with encoded commands shown decoded.
Principal: The field in a bucket policy that says who gets access. A star (*) means everyone, signed in or not, which makes the bucket public.
Privacy screen filter: A laptop screen cover that makes the screen look dark from the side, which defends against shoulder surfing.
Private key and public key: A matched pair of keys. The identity provider signs tokens with its secret private key, and apps check those signatures with its public key.
Prompt injection: An attack on a large language model in which text written by an attacker changes what the model does, for example by overriding a chatbot's rules. It is the top weakness in the OWASP Top 10 for LLM Applications, and it is one reason an AI chatbot adds to the attack surface.
Public object storage: A bucket or container that anyone on the internet can read (or write) without signing in, like the kc-wholesale-exports bucket that exposed café discounts.
Public repository: A code repository anyone can read, or a public registry such as npm or PyPI that software downloads packages from. It can leak secrets kept in history or deliver malicious packages.
PUP (potentially unwanted program): A label security tools give adware and similar software that the user technically agreed to install, often through a pre-ticked box.
Push protection: A GitHub feature that blocks pushing known kinds of secrets to public repositories. It only knows some key formats and can be bypassed.
PyPI (Python Package Index): The public package registry for Python. Anyone can publish to it.

R

Ransomware: Malware that makes files unusable, usually by encrypting them, and demands payment; it often steals data and deletes backups first. The first response is to disconnect affected systems and keep them powered on.
Raspberry Pi: A tiny, cheap computer that attackers can hide as a drop box. Its MAC prefix is b8:27:eb.
RAT (remote access Trojan): A Trojan that gives the attacker full remote control of files, screen, camera and keyboard. Priya's 'LabelMaker Pro Free' was probably one.
Registry (Windows registry): Windows' database of settings. Fileless malware often adds a value under the Run key so a script starts at every sign-in.
Remote wipe: Erasing a lost or stolen device over the network, for example from an MDM console.
Replay: Recording an unprotected command, such as 'unlock', and playing it back later.
Repository (repo): A store of files with their full history, usually code managed with Git.
RF (radio frequency): Radio signals, taught in the previous book as a signal-based attack vector.
RFID (radio frequency identification): Tags read by a nearby reader, such as stock labels and access badges.
Rogue access point: An unapproved access point plugged into the network, often by staff who want better signal. It can let people in the parking lot reach the wired network.
Rogue device: Any device connected to the network without approval, like the Raspberry Pi taped under the shipping desk. Nobody patches it or watches it.
Rogue DHCP server: An unapproved DHCP server on the network. If it actively hands out an attacker's gateway, that counts as a 2.5 attack.
Rooting: The Android version of jailbreaking: removing the maker's limits for full control. It often stops updates.
Rootkit: Malware that hides itself and other malware by changing the operating system or what runs below it, so the system's own tools lie. Its sign is tools that disagree, and the fix is to rebuild from known-good media.

S

SAE (Simultaneous Authentication of Equals): The WPA3-Personal sign-in method, which resists offline password guessing.
Scheduled task: A job the system runs automatically at set times. A new or unexplained one can point to a Trojan or a logic bomb.
Secure Boot: A UEFI feature that only lets signed, trusted boot software start. It is a main defense against bootkits.
Sensitive information disclosure: An OWASP LLM risk where the model reveals personal data, keys or internal facts.
Separation of duties: Splitting important tasks between people so that no one person can make risky changes alone.
Session cookie: A small piece of data the browser keeps to prove 'already signed in'. If stolen, it works without the password or second factor.
SHA-256 (Secure Hash Algorithm, 256-bit): A widely used hash function that makes a 256-bit fingerprint of a file.
sha256sum: A Linux command that prints a file's SHA-256 hash, so you can compare it with the vendor's published one.
Shadow copies: Snapshots Windows keeps so it can restore old versions of files. Ransomware deletes them before encrypting.
Shadow IT: Technology staff use for work without IT's knowledge or approval, such as Sam's free file-sharing link or Priya pasting complaints into a personal chatbot. It is usually well meant, but data leaves the company and escapes backups.
Shimmer: A paper-thin device slid inside a card's chip slot between the chip and the reader. It is harder to see than a skimmer.
Shoulder surfing: Watching someone enter or read sensitive information such as a password, PIN or screen, like the man at the next café table watching Sam.
Sideloading: Installing a phone app from outside the official store, so it skips the store's review and signing checks.
Signal-based vector: Radio paths an attack can travel, such as Bluetooth, RF and NFC. This differs from flaws inside low-power devices themselves.
Signature: A byte pattern or hash taken from known malware, which antivirus uses to recognize it.
Signing key: The private key an identity provider uses to sign tokens. With it, an attacker can forge valid tokens for anyone, as Storm-0558 did.
Single sign-on (SSO): Signing in once at an identity provider and getting into many apps without being asked again, as Kettle & Crane staff do each morning.
Skimming: Stealing card data with a skimmer fitted to a genuine reader, often with a pinhole camera or fake keypad to get the PIN. Take the terminal out of service but leave the device on it as evidence.
SMB (Server Message Block): The Windows file-sharing protocol on TCP port 445. WannaCry spread through a flaw in its version 1.
Spoofing: Faking an identifier, for example a drop box copying an approved printer's MAC address. That is why a matching MAC does not prove a device is approved.
Spyware: Malware that secretly watches the user and sends what it collects to someone else. It hides, unlike adware, which shows itself.
ss -tln: A Linux command that lists listening TCP ports and the addresses they listen on.
SSH (Secure Shell): A protocol for remote command-line login. A 'printer' that suddenly speaks SSH is suspicious.
Stalkerware: Spyware sold to watch a partner or family member, like the hidden 'System Service' app on Sam's phone.
Storm-0558: The name Microsoft gives a group that in 2023 used a stolen Microsoft signing key to forge tokens and read email at about 25 organizations.
Supply chain: Risk that comes from a model, plugin, dataset or package made by someone else that turns out weak or malicious, such as the backdoored xz utils.
SYN: The first packet of a TCP connection, which asks 'may I connect?'. One host sending SYNs to many neighbors on one port is a worm sign.
System prompt: The hidden instructions the company writes for its chatbot. Never put secrets in it, because users can make the model reveal it.
System prompt leakage: An OWASP LLM risk where the hidden instructions, and any secrets in them, are revealed, like the shipping password in the shop chatbot's prompt.

T

Tailgating: Following an authorized person through a secured door unnoticed, without using your own credential. The sign is one badge swipe with two people on camera.
TCP (Transmission Control Protocol): The protocol most network services use to make connections. Port numbers pick out each service.
Token: A short signed message from the identity provider that says who a user is and when they signed in. Apps accept it instead of asking for a password, so a stolen one is as good as a login.
Trojan: Malware disguised as something the user wants, which the user installs willingly. It does not copy itself to other computers.
tshark: A command-line packet capture tool. The worm lab uses it to record the port 445 connection attempts.
Typosquatting: Publishing a malicious package named like a popular one with a small typo, waiting for a developer to mistype.

U

UEFI (Unified Extensible Firmware Interface): The modern motherboard firmware that starts the computer before the operating system. Bootkits target it.
Unmanaged system: A known, approved device that IT does not look after, such as an old kiosk nobody patches. A rogue device, by contrast, was never approved.
USB (Universal Serial Bus): The common plug for keyboards and drives. A hardware keylogger can sit on a USB keyboard cable, and a clean USB drive can scan a possibly rootkitted system from outside.
UTF-16LE: A way of storing text with two bytes per letter. PowerShell encoded commands use it under the base64 layer.

V

VBA (Visual Basic for Applications): The macro language in Microsoft Word and Excel that macro viruses are written in.
Virus: Malware that attaches itself to a host such as a program or document, runs when a person opens that host, and copies itself into other hosts. Unlike a worm, it needs a user to start it.
vssadmin delete shadows: A real Windows command that deletes all shadow copies without asking. Ransomware runs it before encrypting, so seeing it is an early warning.

W

WannaCry: Ransomware carried by a worm in May 2017 that spread through an SMBv1 flaw on TCP port 445. Microsoft's fix, bulletin MS17-010, came out two months earlier, and computers that had it could not be infected that way.
Web proxy: A server that web traffic passes through. Its logs show which cloud services staff visit, which helps find shadow IT.
WEP (Wired Equivalent Privacy): An old, broken Wi-Fi security setting whose key can be recovered from captured traffic in minutes. Never use it.
Wiper: Malware that looks like ransomware but destroys data with no way back, even after payment. NotPetya (2017) is the famous case.
WMI (Windows Management Instrumentation): A built-in Windows management feature. Fileless malware abuses it to run code and to restart at sign-in.
Worm: Malware that copies itself from computer to computer over the network through a flaw, with no user action. The sign is one host knocking on many others on one port, as on the slow Wednesday.
WPA with TKIP (Wi-Fi Protected Access, Temporal Key Integrity Protocol): An old stopgap Wi-Fi setting made for WEP-era hardware, now deprecated and due for replacement.
WPA2 or WPA3-Enterprise: Wi-Fi security where each user signs in with their own account through 802.1X. It is the best choice for staff.
WPA2-Personal: Wi-Fi security with one shared passphrase. Anyone who records the handshake can guess weak passphrases offline.
WPA3-Personal: The preferred personal Wi-Fi setting. It uses SAE, which resists offline guessing.
WPS (Wi-Fi Protected Setup): A feature that lets a device join Wi-Fi with an eight-digit PIN. A design flaw lets tools guess the PIN in hours, so turn it off.

X

xz utils: A widely used compression tool. In March 2024, versions 5.6.0 and 5.6.1 were found to contain a backdoor (CVE-2024-3094) added by a contributor who spent years gaining the maintainers' trust.

Z

Z-Wave: A low-power mesh network on 908 MHz for home and building automation.
Zigbee: A low-power mesh network for sensors and smart lights, built on IEEE 802.15.4 and mostly on 2.4 GHz. The roastery's temperature sensors use it, and their hub with its default password was the real weak spot.