Glossary

216 terms from Vulnerability Management and Monitoring, in plain words, each with the chapter that teaches it.

Search the glossary

A

access log: An application's record of every request, with the visitor's address, the time, the page and the status code sent back. Its partner, the error log, records crashes, failed queries and unexpected input.
agent: A small program installed on each device that collects data there, such as logs, processes, file changes and installed software, and sends it to a central server. Agents give deep, real-time detail and keep working on laptops that leave the office, but they must be installed, patched and protected.
agentless monitoring: Monitoring that installs nothing on the device: the central tool connects over the network, signs in with an account, or reads data the device already sends, such as syslog messages or an API. It suits printers, switches, cameras and cloud services.
alert: An automatic notice from the monitoring system that something matched a rule, saying what happened, where, when and how serious it is. Alerting is the activity of watching logs and metrics and notifying people, such as texting whoever is on call about a critical alert.
alert fatigue: What happens when people see so many false alarms that they stop reading alerts, so real attacks get missed. Alex silencing a phone after hundreds of scan-window alerts every Wednesday is an example.
alert tuning: The ongoing work of adjusting alert rules so alerts are accurate, few and worth acting on. You raise thresholds, narrow rules, add limited exceptions and group duplicates, and you never just switch a noisy rule off, because that creates false negatives.
anomaly rule: An alert rule that fires on behavior far from the baseline, such as an account signing in at 3 a.m. for the first time or uploads 20 times the usual size.
antivirus: Software that finds malware in files using signatures, heuristics and behavior. As a monitoring tool it reports detections, its own health (whether it is running and how current its signatures are) and scan results to a central console and the SIEM.
API: Application programming interface: the interface a service offers to other programs. CSPM tools and log collectors read cloud accounts through the provider's API.
application monitoring: Watching how business programs such as the shop or the wholesale portal behave and who uses them. It covers access logs, error logs, in-app security events, performance and availability.
application scan: A dynamic scan that tests a running website for flaws such as injection by sending crafted requests to its pages. Nikto's scan of the forgotten admin page is an example.
Approved Scanning Vendor: An outside company approved under PCI DSS to run a merchant's external vulnerability scans. Rescans continue until no finding scored CVSS 4.0 or higher remains.
archiving: Moving older logs from the fast, searchable store to cheaper long-term storage, keeping them for the retention period and then deleting them. At Kettle & Crane, months 4 to 12 sit in the archive and must be restored before anyone can search them.
attack path: The route pen testers show by joining several findings together. At Kettle & Crane, three medium findings (guest Wi-Fi, printer default password, saved admin password) chained together reached the order database, so all three became top priority.
audit: A formal review, by someone independent of the work, that the vulnerability management process was followed and its records are true. An auditor checks, for example, that fixes met deadlines and that every exception is signed and unexpired.
automation: One task done by a machine without a person, such as blocking an address. Orchestration coordinates many automated tasks across tools.
availability check: A simple monitor that loads a page, such as the shop's home page, from outside every minute and raises an alert if it fails.
awk: A Linux command that reads text line by line and prints chosen words (fields) from each line. For example, `awk '{print $(NF-3)}'` prints the fourth word from the end of each line, which in an SSH failed-password log line is the source address.

B

backout plan: Part of a change request that says how to undo a change, such as removing a patch, if it fails.
Bandit: A free static analysis tool for Python code. On the contractor's code it flagged a hardcoded password (CWE-259) and a possible SQL injection (CWE-89), giving a severity and a confidence for each.
base metrics: The CVSS metric group that describes the flaw itself, the same in any company. NVD and vendors publish only the base score, and each organization adjusts it for its own environment.
baseline: A record of what normal or approved looks like. For monitoring, it is normal activity (a few sign-ins a day on the order server, CPU under 20%); for settings, it is the approved configuration that drift is measured against.
benchmark: A published set of recommended secure settings for one product, written setting by setting by experts. A benchmark scan compares systems with it again and again, so any failure or drift becomes a finding.
Binding Operational Directive 22-01: A CISA directive that requires US federal agencies to fix each flaw in the KEV catalog by the due date listed with it. Private companies aren't bound by it, but many copy the idea and patch KEV flaws first.
block mode: A DLP mode that stops the risky action, such as sending a card-number file, and records it. The user may be allowed to give a business reason.
bug bounty platform: A service such as HackerOne or Bugcrowd that runs a company's bounty program. It brings in researchers, handles payments and often does the first triage of reports.
bug bounty program: A program that pays outside finders a reward for each valid, new vulnerability they report, following a published scope, rules and reward table. It can be private (invited researchers) or public, and it needs a mature fix process behind it.

C

CASB: Cloud access security broker: a tool that controls how users use cloud apps. Don't confuse it with CSPM, which checks cloud account settings.
change management: The process that approves changes such as patches or setting changes before they happen, with an approved request, a maintenance window and a backout plan. Urgent fixes go through an emergency change process.
CIS Benchmarks: Free, consensus-written secure-setting guides from the Center for Internet Security, covering many products, including cloud accounts (the Foundations Benchmarks). Most have a Level 1 and a Level 2 profile.
CISA: Cybersecurity and Infrastructure Security Agency, the US government's cyber defense agency. It publishes the KEV catalog and issued Binding Operational Directive 22-01.
ClamAV: A free antivirus scanner. Its clamscan command (-d for a signatures file, -r for subfolders) flagged invoice.pdf.exe as FOUND, matching a test signature, and marked orders.csv OK.
clickjacking: A trick where another site shows your page inside a hidden frame so visitors click on it without realizing. Pages prevent it by sending the X-Frame-Options header.
compensating control: A different safeguard that reduces the same risk while the real fix waits, such as a firewall rule, a WAF rule or extra monitoring. The flaw is still there, so the finding stays open.
Computer Fraud and Abuse Act: A US computer crime law. Testing someone else's systems without permission can break it, which is why disclosure policies offer safe harbor.
confidence: In a tool's finding, how sure the tool is that the problem is real, as opposed to severity, which says how bad it would be. Bandit's low confidence on the SQL injection told a human to confirm it.
configuration change: A fix for a finding that comes from a wrong setting rather than broken software: switching off an unneeded service, changing a default password, or removing public cloud access. Stopping the forgotten admin page on port 8080 is an example.
confirming: Checking a finding by hand or with a second tool before anyone spends time fixing it, for example by looking at the installed update level. It weeds out false positives.
correlation rule: An alert rule that links related events from several sources by user, address, device or time and raises one alert, such as a VPN sign-in from a new country, then a new admin account, then a large upload. Correlation is the SIEM's main strength.
CPU: Central processing unit, the computer's processor. Unusually high CPU use, such as 100% all night, can be a sign of a cryptominer.
credentialed scan: A vulnerability scan that signs in to each system with an account given to the scanner, so it reads the installed software, update level and settings from inside. It finds more and gives fewer false positives than a non-credentialed scan.
cross-site scripting: A web weakness, numbered CWE-79, in which a site can be made to send an attacker's script to other visitors' browsers. It topped MITRE's 2025 CWE Top 25 list.
cryptominer: A program that uses stolen computing power to mint cryptocurrency. It often shows up as a server running at 100% CPU.
CSIRT: A national computer security incident response team. Under the EU Cyber Resilience Act, makers report actively exploited vulnerabilities to the national CSIRT acting as coordinator and to ENISA.
CSPM: Cloud security posture management: a tool that continuously checks cloud account settings against security rules through the provider's API. It finds problems such as Kettle & Crane's public invoice bucket or an admin account without MFA, which a network scanner can't see.
CVE: Common Vulnerabilities and Exposures: a public naming system that gives each individual flaw in a product an ID such as CVE-2026-12345. Scan findings usually carry a CVE name.
CVSS: Common Vulnerability Scoring System: a score from 0.0 to 10.0 with a rating (None, Low, Medium, High, Critical) that describes how bad a flaw is in general, plus a vector saying how the flaw is reached and what it harms. It is a starting point, not the final priority.
CWE: Common Weakness Enumeration: MITRE's public list of software weakness types. CWE-89 is SQL injection wherever it appears, while a CVE names one flaw in one product.
cyber insurance: A policy that pays some costs of an attack, such as recovery, legal advice and lost income. It transfers the financial risk to the insurer but fixes nothing.
Cyber Resilience Act: An EU law that, since September 11, 2026, requires makers of products with digital elements sold in the EU to report actively exploited vulnerabilities: an early warning within 24 hours, a notification within 72 hours, then a final report.

D

dependency scan: A scan that reads the list of software libraries an application uses and reports any with known CVEs. Developers call it software composition analysis.
DHCP: Dynamic Host Configuration Protocol: the service that hands out IP addresses to devices automatically. IPAM records its leases.
DISA STIGs: Security Technical Implementation Guides from the US Defense Information Systems Agency: benchmarks required for US Department of Defense systems.
discovery scan: A scan that only finds which addresses have a device on them, without checking ports, such as nmap -sn. Comparing its results with IPAM exposes unknown devices like Jo's camera.
DLP: Data loss prevention: a tool that finds sensitive data such as card numbers or payroll files and stops it leaving where it should stay. As a monitoring tool it records incidents (who, what data, where it was going) and feeds them to the SIEM.
DNS: Domain Name System: the service that maps names to IP addresses. IPAM records the DNS names that point to each address.
dpkg: The package tool on Debian-based Linux such as Ubuntu. dpkg -s openssh-server shows the exact installed package version, which Alex used to validate a fix even though the main OpenSSH version didn't change.
drift: A setting that has changed away from its approved baseline or benchmark, such as the admin page coming back after a contractor restored an old backup. Repeated configuration or benchmark scans catch it.
duplicate: In a bounty program, a later report of a flaw someone else already reported. Usually only the first finder is paid.
dynamic analysis: Testing a running application to see how it behaves. An application scan and fuzzing are both dynamic.

E

EDR: Endpoint detection and response: agent-based software on laptops and servers that detects threats and can act, for example isolating the laptop that clicked a phishing link in an orchestration playbook.
EICAR test file: A harmless standard file that every antivirus vendor detects, used to test that antivirus is working.
emergency patch: A patch installed outside the normal schedule, through the emergency change process, because the flaw is being exploited now, such as the payment plug-in fix.
ENISA: The European Union's cybersecurity agency. Under the Cyber Resilience Act, exploited vulnerabilities are reported to it through its single reporting platform.
environmental metrics: The CVSS group, and the questions, that describe your own systems: is the system internet-facing, does it hold card data, is it business-critical, and does a control already block the attack? The organization supplies these itself.
EPSS: Exploit Prediction Scoring System, run by FIRST: it gives the chance that a flaw will be exploited in the next 30 days, which helps rank findings.
exception: A temporary, approved permission not to meet a rule, with an owner, a reason, compensating controls and an expiry date, such as the 14-day exception for the payment plug-in. In alert tuning, an exception is a limited rule carve-out for a known source, such as the scanner during its Wednesday window.
executive report: A short, plain-language report for the owner or board covering the biggest risks, trends and the decisions or money needed. A pen test report also opens with an executive summary for managers.
exemption: A long-term release of a system from a rule that can't apply to it, reviewed periodically and signed by the owner. The roaster control PC is exempt from monthly patching because its maker supports only an old Windows version.
exposure factor: The share of an asset's value, as a percentage, that one successful attack would destroy. A flaw that could wipe the order database has a higher exposure factor than one that leaks a version number.
external reporting: Vulnerability reporting that crosses the company's walls: outsiders reporting flaws they found in your systems, and you telling customers about flaws in what you make, usually in a security advisory.
external scan: A scan run from the internet toward the company's public addresses, such as the shop. It shows what any stranger can reach.

F

false negative: A real flaw or attack that the scanner or alert rule missed. It is the more dangerous error, because nobody knows to look.
false positive: A reported flaw that isn't really there, or an alert on normal activity. Examples are Nikto calling Python's simple server outdated, or a scanner flagging OpenSSH 9.6p1 that Ubuntu has already fixed.
file integrity monitoring: Watching for changes to system files and settings by comparing them with stored hashes.
finding: One problem reported by a scan, review or test, usually with a severity and often a CVE name and fix advice.
FIRST: Forum of Incident Response and Security Teams, the organization that runs EPSS.
full disclosure: Publishing a flaw's details at once, before any fix. It forces the vendor to act, but attackers learn of the flaw at the same moment as everyone else.
fuzzing: Dynamic testing that feeds a running application malformed or random input to see what breaks.

G

GDPR: General Data Protection Regulation, a European Union law that protects the personal data and privacy of people in the EU. Because a government sets it, it is a law or regulation, unlike an industry standard such as PCI DSS, which an industry body sets.
grep: A Linux command that keeps only the lines containing some text. grep "Failed password" central.log picks out the failed SSH sign-ins.

H

hardcoded secret: A password or key typed directly into code, such as DB_PASSWORD = "Roast2026!" in the contractor's code. Bandit flags it as CWE-259.
hash: A short fingerprint calculated from a file. If the file changes, the hash changes, so stored hashes prove that files or archived logs weren't altered.
HIPAA: Health Insurance Portability and Accountability Act, a US law that protects the privacy and security of people's health information. Because a government sets it, it is a law, unlike an industry standard such as PCI DSS, which an industry body sets.
HTTP: Hypertext Transfer Protocol, the protocol for web pages, normally on port 80. It isn't encrypted, so the packet capture showed Alex's username and passwords in plain text.
HTTP status codes: The numbers a web app sends back for each request, shown in its access log: 200 success, 401 not allowed (for example a wrong password), 404 not found. A burst of 404s for odd page names from one address is what a scan looks like.
HTTPS: HTTP Secure: web traffic encrypted so it can't be read in a capture, normally on port 443. security.txt is served over HTTPS so finders know it is genuine.

I

IETF: Internet Engineering Task Force, the body that publishes internet standards as RFCs, including RFC 9116 for security.txt.
infrastructure monitoring: Watching what connects and supports systems: routers, switches, firewalls, Wi-Fi, VPN gateways, DNS and DHCP servers, the cloud network, power and cooling. It looks at availability, traffic, logs, configuration changes and environment.
internal reporting: Telling people inside the company what was found, what was fixed and what is still open, at the level each audience needs: technical tickets, management trends or an executive page.
internal scan: A scan run from inside the office network.
intrusive scan: A scan that actually tries some attacks to confirm a flaw. It is more certain but can crash a fragile service, so it needs permission and usually a maintenance window.
IPAM: Internet Protocol Address Management: the practice and software for tracking every subnet, address, owner, DHCP lease and DNS name. Comparing it with a discovery scan finds unknown devices, and it tells you what to scan and who owns each finding.
ISO/IEC 29147: An international standard on vulnerability disclosure: dealing with finders and publishing advisories.
ISO/IEC 30111: An international standard on vulnerability handling: the internal process of fixing reported flaws.

K

KEV: CISA's Known Exploited Vulnerabilities catalog, which lists flaws attackers are using now. A KEV listing can put a lower-scored flaw, like Kettle & Crane's VPN gateway flaw, ahead of higher-scored ones.

L

legal hold: An instruction to keep everything about a lawsuit or investigation until it is over, overriding routine deletion, such as holding the shop logs after the card misuse report.
Level 1 and Level 2 profiles: The two common CIS Benchmark profiles. Level 1 is a basic set safe for almost any system; Level 2 adds stricter settings and may break some features.
log aggregation: Collecting logs from all sources into one central place, where they are parsed into common fields and stored, so one search covers every source and copies survive if an attacker deletes local logs. A log aggregator only collects and stores; a SIEM adds correlation and alerting.
log retention policy: A policy saying how long each kind of log is kept and where. Kettle & Crane follows PCI DSS: 12 months in total, the most recent three immediately searchable.

M

MAC address: The hardware (Media Access Control) address of a device's network card. Alex used it to find Jo's unknown camera on the switch.
maintenance window: An agreed time for changes such as patches, restarts or intrusive scans, when disruption does least harm.
management report: A report for managers with counts and trends: open findings by severity, overdue items, exceptions expiring soon and teams falling behind.
manual review: Another developer reading each code change before it is accepted. It is good at finding logic flaws such as a missing permission check, but slow.
MaxAuthTries: An SSH server setting for how many password attempts one connection allows. The order server's value of 6 failed the CIS benchmark's limit of 4.
metrics: Measures reported the same way every month so trends show, such as open findings by severity, average time to remediate, share fixed within deadline, overdue items and scan coverage.
MFA: Multifactor authentication: signing in with more than just a password. An admin account without MFA is a typical CSPM finding, and insurers ask about it.
MITRE: The organization that runs the CWE list and publishes the yearly CWE Top 25.
monitor mode: A DLP mode that logs and alerts without blocking, so new rules can be tuned for false positives before they block anything.

N

NetBox: A free IPAM tool. Windows Server also has a built-in IPAM feature.
NetFlow: A protocol that network devices use to send summaries of traffic for monitoring.
network tap: A small hardware device placed in a network cable that copies every packet passing through it, so a packet analyzer can see the traffic.
Nikto: A free web server scanner. Its scan of the forgotten admin page found a missing X-Frame-Options header and a false-positive "outdated" warning.
NIST: National Institute of Standards and Technology, a US agency. It runs the NVD and publishes SP 800-40 on patch management.
Nmap: A free network scanning tool, which the objectives call a network mapper. -sV asks each open port which program and version runs, -sn finds devices without scanning ports, and -p scans only the named port.
non-credentialed scan: A scan from the outside with no account on the system. It sees only open ports and version banners, which is an attacker's view, and gives more false positives.
non-disclosure: A finder telling no one about a flaw, or selling it privately, so users stay exposed with no fix coming.
non-intrusive scan: A scan that only looks, checking versions and settings without trying any attack.
normalize: To parse logs from different formats into the same fields (time, host, user, source address, event type), so that a search like user = admin works across every source.
NTP: Network Time Protocol, used so every device sets its clock from the same source and events in the central log line up in the right order.
NVD: National Vulnerability Database: the US government's public database of CVE records, run by NIST. Since April 2026 NIST enriches the most urgent CVEs first, so many records carry only the publishing organization's score.

O

OpenSCAP: A free scanner that reads SCAP content and checks systems against benchmarks. It checked the order server's SSH settings against four CIS Level 1 rules and scored them 25 out of 100.
OpenSSH: The SSH server program on the order server (version 9.6p1). Ubuntu fixes its flaws without changing that main version number, so only the package version shows the fix.
orchestration: Connecting tools so they work together in a defined order without a person moving data between them, for example SIEM to threat intelligence to web proxy to EDR to ticket. It works at machine speed, so playbooks are tested and risky steps wait for a person.

P

packet analyzer: A tool that captures packets crossing a network and decodes them, showing exactly what was sent, such as plain-text passwords over HTTP. Use it only with permission, and protect the capture files.
parameterized query: A database query that keeps user data separate from the SQL command, which fixes SQL injection.
patch: An update from the vendor that fixes a flaw; patching is installing it. Patching safely means testing, approval, deployment in a window, a restart if needed, and verification.
patch management: A routine process for finding, testing and installing patches on every system, described in NIST SP 800-40.
Patch Tuesday: The second Tuesday of each month, when Microsoft releases most Windows patches.
PCI DSS: Payment Card Industry Data Security Standard: an industry standard that card brands require of merchants by contract. It requires internal and external vulnerability scans at least every three months with rescans, and audit logs kept 12 months with the last three immediately available.
penetration test: A test in which people hired with written permission act like real attackers to show what they could actually reach. It is a fixed-fee engagement with fixed dates and a report.
penetration test report: The result of a pen test: executive summary, scope and rules of engagement, methodology, findings with evidence, attack paths and recommendations. You review it by checking scope, confirming findings, comparing with your scans and re-ranking.
PermitRootLogin: SSH server settings. PermitRootLogin yes lets the root administrator account sign in directly over the network and failed the benchmark; PermitEmptyPasswords no blocks empty passwords and passed.
playbook: A written set of steps an orchestration tool follows for one kind of alert, such as the phishing-link playbook that checks the link, blocks it at the web proxy, isolates the laptop and opens a ticket.
port: A numbered door for one network service: 22 for SSH, 80 for web pages, 443 for secure web pages. Scans list which ports are open and what answers on them.
port mirroring: A switch setting that sends copies of other devices' traffic to one port, so a packet analyzer there can see it.
port scan: The scan step that finds which network ports are open on a device and asks each service which program and version is answering, as nmap -sV does.
posture: The overall state of your security settings, as in cloud security posture management.
prioritization: Deciding the order in which to fix findings, using severity assessment and pen test reports, not CVSS score alone.
Project Zero: Google's security research team. Its "90+30" disclosure policy gives vendors 90 days to fix and publishes details 30 days after the fix ships, or allows only 7 days if the flaw is already exploited.

R

remediation: Removing a vulnerability, or reducing its risk to a level the company accepts, through a patch, configuration change, compensating control, segmentation, insurance or a recorded exception or exemption.
remediation timeline: A company's deadlines for fixing by severity. Kettle & Crane's are critical in 7 days, high in 30, medium in 90, low at the next window, and KEV flaws on internet-facing systems in 48 hours.
rescan: Running the same kind of scan again against a fixed system and comparing results. If the finding is gone, the fix is verified, as when port 8080 disappeared from the order server's scan.
responsible disclosure: Reporting a flaw privately to the organization that can fix it, giving it time, often 90 days, and only then publishing the details, so users get a fix before attackers get the details.
responsible disclosure policy: The public page where an organization tells finders how to report flaws: scope, reporting channel, rules, safe harbor and what happens next. Kettle & Crane published one after a stranger emailed Priya about the order-page flaw.
retest: Asking the pen testers to try their attack again after a fix. It is a form of validation.
reward table: The part of a bounty program that sets payment by severity, such as $100 for a low finding and $2,500 for a critical one.
RFC: Request for Comments, an internet standard document published by the IETF. RFC 9116 defines the security.txt file.
risk register: The list of known risks where exceptions and exemptions are recorded.
risk tolerance: How much risk the company is willing to accept. Kettle & Crane's owner accepts some on the guest Wi-Fi but none on systems that touch card payments.
rogue device: A device connected without permission, found because it answers a discovery scan but isn't in IPAM, like Jo's camera.
root: The Linux administrator account. A failed password for root in the SSH log means someone tried to guess the admin password.
rsyslog: The log service on most Linux systems. In the lab, omfwd forwards every message to the collector at 10.15.0.1, omfile writes messages to a file, and imudp lets the collector accept syslog over UDP.
RTSP: Real Time Streaming Protocol, used by video cameras on port 554. An open port 554 gave away Jo's camera.
rules of engagement: The part of a pen test agreement that says which systems may be tested, when, and what was allowed.

S

safe harbor: A promise in a disclosure policy or bounty program not to take legal action against people who test in good faith within the rules. Scope says what may be tested; safe harbor protects the testers.
scan coverage: The share of known assets that were actually scanned, found by comparing the scan list with the asset inventory and IPAM. A report of "zero criticals" means little with poor coverage.
SCAP: Security Content Automation Protocol: a set of standards for writing benchmarks in machine-readable form so scanners like OpenSCAP can check them automatically. The free SCAP Security Guide project supplies such content.
scheduled scanning: Scans that repeat on a schedule to notice change: new findings, new devices, drift from approved settings. An example is the nightly port check that would catch the admin page coming back.
security advisory: A vendor's published notice about a flaw and its fix, sometimes with workarounds. Validation compares the installed version with the fixed version the advisory names.
security monitoring: Watching what is actually happening on systems, applications and infrastructure all the time, so an attack, failure or mistake is noticed quickly. It compares activity with a baseline and covers log aggregation, alerting, scanning, archiving, reporting and alert tuning.
security.txt: A small text file at /.well-known/security.txt, defined by RFC 9116, that tells finders where to report flaws. Contact and Expires are required; Kettle & Crane's points to security@kettleandcrane.com and its policy.
segmentation: Splitting a network into separate parts with controlled paths. As a remediation it puts a system that can't be patched, like the roaster control PC, in its own segment, and it broke the guest Wi-Fi attack chain.
severity: How bad a finding or alert would be (Low to Critical). For alerts it decides who is told and how fast.
severity assessment: Working out how serious a finding is for your company. You start from the CVSS base score, then add exploitation (KEV, EPSS), environment, exposure factor and risk tolerance.
shared responsibility model: The split of cloud security duties. The provider secures buildings, hardware and much of the software; the customer sets up the account, including who signs in, what is public and what is logged.
SIEM: Security information and event management: the central monitoring tool that collects, normalizes, correlates, alerts on, stores and reports on events from every source. It would have linked the stolen-password VPN and server sign-ins into one alert.
signature: A pattern for something known to be bad. Antivirus matches files against signatures, and a match alert rule fires when a known bad event appears, such as a user added to Administrators.
SNMP: Simple Network Management Protocol, used by infrastructure devices to report health and counters.
SOAR: Security orchestration, automation, and response: a tool that acts on alerts by running playbooks across other tools. A SIEM finds alerts; SOAR acts on them.
sort: A Linux command that puts lines in order, used before uniq -c to count failed sign-ins per address.
source code review: Examining an application's source code for security weaknesses before it goes live, by hand and with static analysis tools. It is the only identification method that finds flaws in code only you have, like the wholesale ordering page.
SP 800-40: A free NIST guide (Revision 4, 2022) to enterprise patch management. It treats patching as routine maintenance every company must plan for.
SQL: Structured Query Language, the language used to send commands to a database, such as SELECT * FROM orders.
SQL injection: A flaw where input from a web form is pasted into a database query, so a visitor can inject their own SQL commands. It is weakness type CWE-89, and a parameterized query fixes it.
SSH: Secure Shell: the protocol for remote login, normally on port 22.
sshd: The SSH service program on Linux. Its log lines, such as "Failed password for invalid user admin", show sign-in attempts.
static analysis: Reviewing code without running it, usually with a tool such as Bandit that flags known bad patterns. It is fast and consistent but gives false positives and misses logic flaws.
storage bucket: A cloud storage area for files. A bucket set to public, like the one holding Kettle & Crane's wholesale invoices, is a classic CSPM finding.
subnet: A range of addresses for one part of the network, such as the office or the guest Wi-Fi. It is often written with a slash: 10.15.0.0/24 means all 256 addresses from 10.15.0.0 to 10.15.0.255.
syslog: The standard way to send log messages over the network, used by servers and network devices to feed a central collector. Ideally it runs over TLS.
system monitoring: Watching one computer and its operating system: performance, sign-ins, account changes, processes and services, file changes and update level.

T

TCP: Transmission Control Protocol, which delivers data completely and in order. Real log setups use TCP with TLS so logs arrive complete and private.
tcpdump: A command-line packet capture tool. tcpdump -i v2b15-br -w login.pcap 'tcp port 80' saved the web packets to a file.
technical report: A detailed report for system owners and IT staff: each finding with host, CVE, severity, evidence, fix steps and deadline, usually as tickets.
threat metrics: The CVSS group that describes exploit maturity, meaning how far working attack code has developed. It was called Temporal in CVSS 3.1.
threshold rule: An alert rule that fires when a count or level crosses a limit, such as 3 or more failed sign-ins from one address in one minute, or a disk over 90% full.
ticket: A tracked work item in a ticketing system, with an owner and a due date. Findings and many alerts become tickets so the response is tracked.
TLS: Transport Layer Security, the encryption used to protect data in transit, for example syslog over TLS.
triage: Checking each incoming report to see whether it is real, in scope and new before it is fixed and paid. In a bounty program the platform often does the first triage.
true negative: A clean result on a clean system, or normal activity with no alert.
true positive: A real flaw correctly reported, or an alert on a real attack.
TShark: Wireshark's command-line version. In the lab it read login.pcap and printed the submitted form values, showing passwords in plain text.

U

UDP: User Datagram Protocol: quick, but it can lose messages and isn't encrypted. The lab sent syslog over it.
uniq: A Linux command that collapses repeated lines. With -c it counts them, here counting failed sign-ins per source address.
unnecessary open port: A service nobody needs that is still listening, like the forgotten admin page on port 8080. It is a finding even without a CVE.
UPS: Uninterruptible power supply, a battery that keeps equipment running during a power cut. Its battery is watched as part of infrastructure monitoring.
UTC: Coordinated Universal Time. A log time ending in +00:00 is in UTC.

V

validation: Checking a fix directly instead of trusting the scanner: reading the installed version, retesting the attack, and confirming the business still works.
verification: Proving that a remediation worked and nothing else broke, by rescan, validation or audit. A finding is closed only with that proof.
version banner: The program name and version a service announces, such as "OpenSSH 9.6p1". Non-credentialed scans guess software from banners, which causes false positives.
virtual patching: Using a WAF rule to block an attack pattern while the real patch waits. It is a compensating control.
VPN: Virtual private network, which gives remote users a secure connection into the company network. The internet-facing VPN gateway flaw in KEV was Kettle & Crane's top priority.
vulnerability: A weakness an attacker could use: a missing update, a bad setting or a flaw in code.
vulnerability management: A repeating cycle of identifying weaknesses, prioritizing them, remediating, verifying and reporting. It repeats because new weaknesses appear every week.
vulnerability scan: An automated check of systems for known weaknesses: discovery, port and service scan, matching against a database, then a report of findings by severity.
vulnerability scanner: The tool that runs vulnerability scans and reports findings with CVE names, CVSS scores and fixes, such as Tenable Nessus, Greenbone OpenVAS, Qualys and Rapid7 InsightVM. It needs an up-to-date database of checks (plug-ins), or it misses new flaws.

W

WAF: Web application firewall: a filter in front of a website that can block attack patterns, such as the rule shielding the payment plug-in until its patch arrived.
web proxy: The server that relays staff web traffic and can block sites. The phishing playbook tells it to block the bad link for everyone.
Windows Event Log: Where Windows records events. In its Security log, event 4624 is a successful logon, 4625 a failed logon, 4720 a new user account, and 4732 a member added to a security group.
Wireshark: The best-known packet analyzer, with a graphical window.
WORM: Write once, read many: storage that can't be changed or deleted before the retention date, used to protect archived logs as evidence.

X

X-Frame-Options: A web response header that stops other sites from framing a page. Nikto reported it missing on the admin page.
X11Forwarding: An SSH setting that allows remote graphical windows. X11Forwarding yes failed the benchmark because the server doesn't need it.
XDR: Extended detection and response: links data from endpoints, email and identity for detection, with built-in response actions. A SIEM by contrast collects from almost any source, keeps logs for compliance and runs your rules.

Z

zero-day: A flaw known to attackers before any fix exists, so a compensating control is needed while the patch waits.