Glossary

154 terms from Security Fundamentals, in plain words, each with the chapter that teaches it.

Search the glossary

A

AAA: The three steps every system takes when someone uses it: prove who you are (authentication), decide what you may do (authorization), and record what you did (accounting). Alex uses it to read Sam's failed attempt to open payroll in auth.log.
Acceptable use policy: A document from management that says how staff may use company computers and networks. In the control grid it is a managerial control.
Access vestibule: A small room with two doors where only one door can be open at a time, so only one person gets through each time. It stops tailgating, which a badge reader alone can't. Older books call it a mantrap.
Accidental actor: An insider who causes harm by mistake rather than on purpose, for example by emailing a customer list to the wrong person.
Accounting: The third A of AAA: recording what people and devices did, usually in logs. It is how Alex knows Sam was refused sudo and that 203.0.113.77 tried to log in as admin.
Actions on objectives: The seventh and last step of the Cyber Kill Chain, where the attacker does what they came for, such as stealing data or encrypting files for ransom.
Adversary: In the Diamond Model, the corner for who carried out the attack. For Sam's fake invoice it is unknown, but the method matches organized crime.
Antivirus: Software that looks for known malicious programs and removes them, which makes it a corrective control. Because it looks for known malware, attackers who live off the land with built-in tools can slip past it.
APT (advanced persistent threat): A skilled, well-funded attacker, usually state-sponsored or a top criminal group, who stays inside a target for months or years in pursuit of a specific goal such as espionage. APTs often get in through suppliers or MSPs and live off the land.
Assume breach: A zero trust habit: design as if an attacker is already inside, and log everything so you notice them. Alex's alert email on every admin login serves it.
Attack complexity (AC): A CVSS metric that asks whether an attack works every time (L, low) or needs luck or special conditions (H, high). The regreSSHion flaw on office-srv is AC:H, which is one reason it ranks below the firewall.
Attack framework: A shared model for putting the steps or parts of an attack in order, so that everyone describes attacks the same way and can see where a defense could have stopped one. Common examples are the Cyber Kill Chain, MITRE ATT&CK and the Diamond Model.
Attack surface: All the threat vectors into one organization added together: every internet-facing service, every person who reads email, every device plugged in. Turning off unused services and accounts makes it smaller.
Attack vector (AV): A CVSS metric for where the attacker must be: N over the network, A on the same local network (adjacent), L logged in on the machine, or P physically present. It is a CVSS score input and not the same thing as a threat vector.
Authentication: Proving who you are, for example with a password, an SSH key or a fingerprint. It always comes before authorization, and devices can authenticate too, for example with a certificate.
Authorization: Deciding what an authenticated person may do, through permissions and group membership. Sam logged in fine but was refused sudo for payroll: that refusal is authorization.
Availability: The CIA goal that information and systems are there when the right people need them. The online shop going down the Friday before a holiday is an availability failure. Backups, spare parts and extra capacity protect it.

B

Base score: The CVSS score from 0.0 to 10.0 that describes the vulnerability itself, not your own setup. Log4Shell's base score is 10.0 Critical.
Bluejacking: Sending unwanted messages to a Bluetooth device that is left discoverable.
Bluesnarfing: Stealing data from a Bluetooth device that is left discoverable.
Bluetooth: Short-range wireless that connects headsets, keyboards, phones and cars over about 10 meters. Its risks come from discovery, pairing in public and bugs, so turn it off when unused, as Alex does on the warehouse scanner.

C

Capability: In the Diamond Model, the corner for the attacker's tools and techniques, such as the macro, PowerShell, certutil and the scheduled task used against Sam.
CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart): A small test that people pass easily and programs find hard, such as picking pictures with traffic lights. It slows down automated password guessing and fake sign-ups, but it doesn't stop a person or a stolen session.
Category: How a control works, meaning what carries it out: technical, managerial, operational or physical. Every control has exactly one category.
CIA triad: The three goals behind every security task: confidentiality, integrity and availability. A backup protects availability, a lock screen confidentiality and a checksum integrity.
CISA (Cybersecurity and Infrastructure Security Agency): The US government agency that publishes free security advisories and the KEV catalog of vulnerabilities attackers are actually using.
CNA (CVE Numbering Authority): An organization allowed to hand out CVE IDs, usually a vendor describing its own bugs. What it writes sits in the cna container of a CVE record.
Collaboration tools: Chat and teamwork apps such as Microsoft Teams, Slack and Google Chat. Staff trust them because they feel internal, so attackers from outside organizations message staff there as fake IT support.
Command and control (C2): The sixth Cyber Kill Chain step, and also an ATT&CK tactic: a planted program contacts the attacker's server, here 203.0.113.50, to get orders.
Compensating: A control type that stands in for a control you should have but can't use. Locking an unpatchable PC in a cabinet and requiring two people to approve every refund are examples.
Competitor: A rival business that wants your secrets, such as customer lists or Kettle & Crane's café prices. It may hire skilled help or bribe an insider, usually for espionage.
Confidentiality: The CIA goal that only the right people can read the information. A stolen laptop exposing the payroll file is a confidentiality failure. Permissions and encryption protect it.
Control: Anything put in place to reduce a security risk, such as a firewall, a door lock, a policy, training or a guard. Each control is described by a category and a type.
Cookie: A small piece of data a website gives your browser, which the browser sends back with every request. For logins it carries the session token, so whoever has the cookie is treated as you.
Corrective: A control type that fixes things after a problem, such as restoring files from backup, antivirus removing a bad file, or sprinklers putting out a fire.
CVE (Common Vulnerabilities and Exposures): The public ID for one known vulnerability, written as CVE, the year and a number, such as CVE-2021-44228 for Log4Shell. The list is published at cve.org, and each record is a JSON file on GitHub.
CVSS (Common Vulnerability Scoring System): A severity score from 0.0 to 10.0, worked out from a vector string of metrics. It measures how bad a bug could be, not what you should fix first.
CWE (Common Weakness Enumeration): A name for the kind of mistake behind a vulnerability, such as CWE-502 Deserialization of Untrusted Data. A CVE is one instance of that kind of mistake in one product.
Cyber Kill Chain: Lockheed Martin's model, published in 2011, that splits an attack into seven ordered steps, from reconnaissance to actions on objectives. The defender only needs to break one link, and earlier is better.

D

Dark web: The part of the internet you can reach only through special software such as Tor, where stolen data is bought and sold.
Dark web monitoring: An intelligence source: a service that watches dark web marketplaces for your company's name, domains or leaked staff passwords.
Data exfiltration: A motivation in which the attacker copies data out of an organization to sell or use. Criminals, states and competitors all do it.
Decision point: In a zero trust design, the part that answers yes or no for each request after checking identity, device and permission.
Defense in depth: Protecting something with several independent layers of controls that differ in kind, so an attacker who gets past one layer meets another. Kettle & Crane's order database is protected by layers for people, network, server, app and data.
Delivery: The third Cyber Kill Chain step, when the attacker sends the weapon to the target, such as the email to Sam with the invoice attached. A mail filter that blocks macro attachments stops the attack here.
Detective: A control type that notices a problem while it happens or afterwards, such as a camera recording, an alert email or a log review.
Deterring: A control type that discourages someone without actually stopping them, such as a "CCTV in use" sign or a login banner. A determined attacker can still ignore it.
Diamond Model: A 2013 model that describes one attack event with four connected corners: adversary, capability, infrastructure and victim. Each known fact leads to the next question, such as which other victims contacted 203.0.113.50.
Digital signature: Proof made with a private key that a file is unchanged and that this key's owner signed it; anyone with the matching public key can check it. Alex signs the Bloom Café order approval this way to get integrity and non-repudiation.
Directive: A control type that tells people what to do, such as a policy, a "Staff only" sign or a training course. It works only if people follow it.

E

Encryption: Scrambling data with a key so that only someone with the right key can read it. It protects confidentiality, for example on laptop disks, in HTTPS and in VPN tunnels.
Enforcement point: In a zero trust design, the part that carries out the decision point's yes or no, such as a gateway in front of each app.
Environmental score: A CVSS score that adjusts the base score for your own setup. If you give no environmental metrics, it equals the base score.
EPSS (Exploit Prediction Scoring System): A score from FIRST that estimates the chance a CVE will be exploited in the next 30 days. It is one input to prioritization.
Espionage: Spying: secretly collecting information such as plans, designs or government data. It is the typical motive of state-sponsored actors, APTs and competitors.
Exploitation: The fourth Cyber Kill Chain step, when the attacker's code runs, for example when Sam clicks "Enable content".
Extension: The end of a file name after the last dot, such as .pdf or .exe, which Windows uses to choose a program. Because File Explorer hides known extensions, invoice.pdf.exe can pass for a PDF: the extension is only a label, not proof of the file's real type.
Extortion: Getting money by threats, such as "pay, or we leak your data" or demanding payment to unlock encrypted files. It is organized crime's typical motive.

F

Financial gain: The motivation of attackers who want money, through card data, fraud or payments. It is most typical of organized crime.
Firewall: A device or software that allows or blocks network traffic by rules. At Kettle & Crane the firewall lets the internet reach only the shop's port 443, and its log, fw.log, is matched against threat feeds.

H

Hacktivist: An attacker who acts for a political, social or environmental cause, for example by defacing websites, leaking documents or knocking sites offline. Skill and money are usually low to medium.
Hash: A fixed-length fingerprint of data that changes completely if even one character changes. It shows that prices.csv was tampered with, but not what changed, and on its own it gives integrity only.
Heat map: A grid with likelihood across and impact up, where each risk is placed by its ratings and the high-score corner is shaded. Figure 5.1 draws Kettle & Crane's seven risks this way.

I

Impact: How much harm a threat does if it happens, such as lost money, downtime or customers. It is rated 1 to 5 and multiplied by likelihood; in CVSS, C, I and A are impact metrics too.
Impersonation: Pretending to be someone the victim trusts, such as the boss, IT support or a printer company, in person, by phone or in chat. Defend against it by verifying through a channel you choose.
Indicator of compromise (IOC): A clue, such as a bad address, domain or file hash, that shows an attacker may have been active. In STIX it is an indicator object with a pattern, and olevba also lists IOCs it finds in macros.
Information-sharing organization: A group where members of one industry share what they see, such as an ISAC. A coffee roaster's warning passed through an industry group is an example.
Infrastructure: In the Diamond Model, the corner for what the adversary used to deliver and control the attack, such as the sending email address and the server 203.0.113.50.
Insider: Someone who already has access, such as an employee, a former employee whose account still works, or a contractor. Insiders can be malicious or careless, and they are the only internal threat actor.
Installation: The fifth Cyber Kill Chain step, when the attacker makes their access stay, such as the scheduled task that runs a.exe every day.
Instant messaging: Chat apps such as WhatsApp, Signal and Messenger that carry text, files and links straight to staff, outside the company's email filters. "It's the boss, new number" is a common trick.
Integrity: The CIA goal that information is correct and nobody changed it without permission. Someone changing the Decaf price from $62 to $26 is an integrity failure, and hashes detect such changes.
Intelligence sources: The places threat intelligence comes from: open-source intelligence (OSINT), proprietary or commercial services, information-sharing organizations such as industry ISACs, and dark web monitoring. Each differs in cost, quality and how much checking it needs.
ISAC (Information Sharing and Analysis Center): The usual US name for an industry information-sharing organization. Retailers and restaurants have one.

J

jq: A command-line tool that picks fields out of JSON with a filter in single quotes, using select, test, length and @tsv. Alex uses it to search ATT&CK, read feed.json, read CVE records and look up KEV.
JSON (JavaScript Object Notation): A text format of named fields like "name": "FIN7", lists in square brackets and objects in curly braces. ATT&CK data, STIX feeds, CVE records and KEV all use it.

K

KEV (Known Exploited Vulnerabilities): CISA's catalog of vulnerabilities attackers are actually using, published as a JSON file. Alex's rank.sh puts KEV findings first, which is why the firewall's 7.5 beats the server's 8.1.

L

Least privilege: Giving every person, program and device only the access its job needs, and taking rights away when the job changes. Jo may run only the command that restarts printing, so a stolen password gets the thief one harmless command.
Likelihood: How probable it is that a threat happens to you in a given period, such as a year. It is rated 1 to 5 and multiplied by impact, and threat intelligence can raise it.
Living off the land: Attacking with tools already built into the operating system, such as PowerShell, certutil, schtasks, rundll32 and WMI, so nothing looks like malware. Logging every program's command line is how you catch it.
Log4Shell: CVE-2021-44228, a 2021 bug in Log4j, a Java logging library, that let an attacker run code on a server just by getting it to log crafted text. It scores 10.0 and is in KEV.

M

Macro: A small VBA program saved inside an Office document, in files ending in m such as .docm. A document that says "Enable content" may run the attacker's code, as Sam's invoice.docm did.
Malicious USB: A USB device, such as a flash drive, a cable or a trade-show gift, that carries malware or pretends to be a keyboard and types commands. Found and gifted devices should go to IT unopened.
Malware: Harmful software, such as programs that steal data or encrypt files. Antivirus looks for known malware, which is why attackers living off the land try to avoid using any.
Managed service provider (MSP): A company that runs IT for other companies and usually holds admin access to all of them, often through a remote monitoring tool. Breaking into one MSP can reach every customer, which makes it a supply chain attack.
Managerial: A control category made of management decisions and documents, such as the acceptable use policy, a monthly review of login reports, or requiring two people to approve every refund.
Mitigation: In ATT&CK, a control listed on a technique's page that stops or limits that technique, such as PowerShell logging.
MITRE: A US not-for-profit that runs ATT&CK and started the CVE Program in 1999.
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge): A free catalog, built from real incidents, of attacker tactics, techniques, groups and mitigations, whose data is a large STIX JSON file. Unlike the Kill Chain, it is not a strict sequence.
Motivation: Why a threat actor attacks. The exam names financial gain, extortion, espionage, data exfiltration, revenge, service disruption, political or philosophical beliefs, chaos and war.

N

Network namespace: A private copy of the network settings that acts like a separate computer. The café lab uses three of them for Priya's laptop, the shop and the guest.
NFC (Near Field Communication): Wireless that works within a few centimeters, used for tap-to-pay, badges and tags that open web pages. A hidden reader can read or relay a card in a crowd, and a planted tag can open a malicious address.
Non-repudiation: A person can't later deny an action they took. A digital signature gives it, but only while the signer alone holds the private key.

O

olevba: An oletools command that extracts macros and flags anything suspicious, such as AutoOpen, Shell, PowerShell and IOC addresses. It showed that Sam's invoice macro downloads and runs a script.
Open-source intelligence (OSINT): Threat intelligence from public sources, such as security blogs, vendor reports, ATT&CK and CISA advisories. It is free, but you must judge its quality yourself.
Operational: A control category carried out by people doing a job day to day, such as a guard checking visitors or Alex restoring files from backup.
Organized crime: Criminal groups that run hacking as a business, with money, skilled members and even help desks, who want money through card theft and ransomware extortion. They are Kettle & Crane's top threat.

P

Password manager: An app that creates, stores and fills in a different long random password for every site, protected by one master password and ideally a second factor. It fills only on the exact saved domain, so it offers nothing on a fake login page.
PDF (Portable Document Format): A document format made of numbered objects, mostly readable text. It can hold JavaScript and actions that run when the file opens, as in statement.pdf.
Phishing: Fake emails or messages that trick people into giving away passwords or opening attacks. At Kettle & Crane it is the top-rated risk and the usual way ransomware gets in; the attack itself is covered in Attacks and Indicators in 50 Pages.
Physical: A control category you can touch in the building, such as a lock on the server closet or a camera over the loading dock.
PowerShell: Windows' built-in command shell and scripting language. Attackers run it hidden with an encoded command (-w hidden -enc), as on Sam's PC, where it downloaded and ran code.
Pretext: A story that makes an impersonator's request sound normal, such as "I'm from the printer company, here for the yearly service".
Preventive: A control type that stops a problem before it happens, such as a firewall rule, a door lock or an encrypted laptop. To tell it from deterring, ask whether a determined person could still get past it.
Prioritization: Deciding what to fix first at your organization, using more than the CVSS score: whether it is in KEV, whether the system is exposed, how important the system is, and how likely exploitation is soon (EPSS).
Private key: The secret half of a key pair, which only its owner should hold. Alex's private SSH key makes the signature on the order approval, and if it is shared, non-repudiation is lost.
Proprietary or commercial intelligence: Paid threat intelligence from security companies, often built into firewalls and antivirus, checked and organized for you.
Public key: The shareable half of a key pair. Anyone with Alex's public key, listed in the signers file, can check Alex's signatures.

Q

QR code: A square barcode that usually holds a web address. People can't read it, so attackers stick their own codes over real ones, like the fake sticker at Bloom Café; decode it and read the domain before you visit.
Quishing: Attacks that use QR codes, for example to send people to a fake payment page.

R

Ransomware: Malware that encrypts an organization's files and demands payment, a form of extortion. Phishing is its usual way in, and KEV marks bugs that ransomware groups use.
RCS (Rich Communication Services): The newer messaging standard that replaces SMS on Android and iPhone, with read receipts, photos and group chats. As of October 2026, end-to-end encryption between iPhone and Android is still rolling out.
RDP (Remote Desktop Protocol): Microsoft's remote desktop protocol, which shows a full Windows desktop in a window, on TCP port 3389. Never expose it to the internet: put it behind a VPN or jump host and require a second factor.
Reconnaissance: The first Cyber Kill Chain step, and also an ATT&CK tactic: researching the target, such as collecting staff names from the shop's About page.
Remote desktop: Controlling a computer's desktop from somewhere else, usually with Microsoft's RDP. It turns a password or a bug into a seat at an office computer.
Revenge: A motivation to hurt a person or employer who wronged the attacker. It drives many insider incidents, such as a former employee deleting the shared drive.
Risk score: Likelihood (1–5) multiplied by impact (1–5), giving 1 to 25; it is a qualitative method because the ratings are judgments, not measurements. "Phishing steals a staff password" scores 16 and tops Kettle & Crane's list.
RTF (Rich Text Format): An old document format that Word opens. It can't hold macros, but it can embed objects such as other files, like the batch file hidden in invoice.rtf.
rtfobj: An oletools command that lists the objects embedded in an RTF file and warns with EXECUTABLE FILE when one is a program.

S

Scope (S): A CVSS 3.1 metric for whether the attack can break out of the vulnerable component into others (C, changed) or stays inside it (U, unchanged). Scope changed lifts Log4Shell from 9.8 to 10.0.
Session hijacking: Stealing someone's session token so you are logged in as them without the password, and often without the second factor. The guest does this to Priya on the café Wi-Fi.
Session key: A fresh secret key that the browser and server agree on for one HTTPS connection and use to encrypt everything in it; it is never sent as is. If stolen, it exposes only that one connection.
Session token: A long random value in a cookie that the server links to your account, so whoever presents it is you. Protect it with HTTPS, short sessions, real logout and a new token at every login.
Severity rating: The word a CVSS score maps to: 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High and 9.0–10.0 Critical (0.0 is None). Severity says how bad a bug could be, which is not the same as priority.
SMS (Short Message Service): The classic text message. The sender's name or number can be faked, and messages aren't encrypted end to end.
Social engineering: Attacks that trick people rather than computers, such as impersonation. They are covered in full in Attacks and Indicators in 50 Pages.
State-sponsored: An attacker working for a government, with the most money and skill of all. They spy, steal technology and prepare to disrupt infrastructure, often as APTs.
STIX (Structured Threat Information Expression): A JSON format for describing threats. A file is a bundle of objects, and an IOC is an indicator object with a pattern, confidence and valid_from; feed.json and the ATT&CK data both use it.
Sub-technique: A more specific form of an ATT&CK technique, written with a decimal in its ID, such as T1566.001 under T1566 Phishing.
Supply chain: Every supplier, vendor and service provider whose products or access an organization relies on, such as Kettle & Crane's shop host, payment provider and MSP.
Supply chain attack: Breaking into a supplier in order to reach its customers. It can happen through poisoned software updates (as with SolarWinds in 2020), tampered hardware, or a compromised service provider such as an MSP.

T

Tactic: In ATT&CK, the attacker's goal at a given moment: the why. Examples are Initial Access, Execution and Persistence, and Enterprise ATT&CK v20 has 15.
Tailgating: Walking into a building behind someone who opened the door with their badge. An access vestibule stops it.
TAXII (Trusted Automated Exchange of Intelligence Information): The protocol that delivers STIX threat intelligence over HTTPS.
Technical: A control category carried out automatically by hardware or software, such as a firewall rule or disk encryption. These are also called logical controls.
Technique: In ATT&CK, how an attacker reaches a goal, with an ID such as T1566 (Phishing). Each technique page lists the groups that use it, how to detect it, and its mitigations.
Temporal score: A CVSS score that adjusts the base score for things like available exploit code. If those metrics aren't given, it equals the base score.
Terrorist: A group that attacks to cause fear or harm for political goals, often aiming at things that affect many people at once, such as power or water systems.
Threat: Anything that could harm what you protect, whether it is a flood, a careless click or a criminal.
Threat actor: A person or group behind a deliberate threat, described as internal or external, by resources and funding, and by sophistication. The main kinds are unskilled attackers, hacktivists, insiders, competitors, terrorists, organized crime and state-sponsored groups.
Threat feed: A continuous stream of machine-readable intelligence, mostly IOCs, that tools download and use automatically. Alex matches feed.json against fw.log.
Threat intelligence: Information about threats that has been checked and put in context so it helps you make a decision: who is active, what they target, how they work, and which addresses and files they use.
Threat profile: A report on what an organization protects and from whom. Kettle & Crane's covers likely actors, top risks, vulnerabilities to fix, feed matches, controls by type and ATT&CK techniques, and a script rebuilds it.
Threat vector: The path an attacker uses to get in, such as a text message, a file, a remote login or a USB stick.
Type: What a control does about a problem: preventive, deterring, detective, corrective, compensating or directive. On the exam you pick the type that matches the job the question describes.

U

Unskilled attacker: Someone who runs tools and scripts that others wrote, often without understanding them, and goes after whatever is easy, such as default passwords. Older books call them script kiddies.

V

Vector string: The CVSS metrics written as text, version first, such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Anyone can see from it why a bug got its score.
Victim: In the Diamond Model, the corner for who or what was hit, such as Sam and Sam's PC.
VNC (Virtual Network Computing): Screen sharing that works on any system, on port 5900 and up. Many VNC servers allow short passwords and send traffic unencrypted, so never expose VNC to the internet.
VPN (virtual private network): An encrypted tunnel from a remote device into the office network, so a laptop at home acts as if it were plugged in at the office. It is safer than exposed RDP, but it is one front door: a stolen VPN password lets the attacker in.
Vulnerability: A weakness an attacker can use, such as a software bug, a bad setting or a missing update. Public ones get CVE IDs.

W

Watering hole: An attack where the attacker breaks into a website the targets visit often, such as the Oregon Coffee Roasters Guild site, and plants code that attacks the visitors. The victims themselves do nothing wrong.
Weaponization: The second Cyber Kill Chain step, when the attacker builds the attack, such as a Word file with a macro that downloads more code.

Z

Zero trust: Trusting no request because of where it comes from: each request's identity, device and permission is checked every time, and access is granted to one app at a time. The design also assumes an attacker is already inside.