Security Glossary

ISO/IEC 27001 is the international standard for running an information security management system (ISMS) — a certifiable, risk-driven way of deciding which security controls you need and proving you operate them.

MITRE ATT&CK is a public, curated catalogue of the behaviours real attackers use, organised so defenders can say "we saw T1059.001" instead of "some PowerShell thing".

The NIST Cybersecurity Framework is a voluntary, outcome-based structure that organises a security programme into six Functions — Govern, Identify, Protect, Detect, Respond and Recover — so you can describe where you are, where you want to be, and the gap between.

DORA is the EU regulation, applicable since 17 January 2025, that makes financial entities and their critical ICT providers prove they can withstand, respond to and recover from ICT disruptions and cyberattacks.

The GDPR is the EU regulation, in force since 25 May 2018, that governs any processing of personal data — including the IP addresses, usernames and e-mail addresses in your logs — and requires security "appropriate to the risk" plus breach notification within 72 hours.

NIS2 is the EU directive that widens cybersecurity obligations from a few critical operators to most medium and large organisations in eighteen sectors, with mandatory security measures, incident reporting and personal liability for management.

PCI DSS is the contractual security standard, set by the card brands through the PCI Security Standards Council, that anyone storing, processing or transmitting payment-card data must meet — currently version 4.0.1.

CIDR notation writes an IP range as an address plus a prefix length — 10.20.30.0/26 — where the number after the slash says how many leading bits are the network and therefore how many addresses the block contains.

CSP is an HTTP response header that tells the browser which sources a page may load scripts, styles, images and frames from — so an injected script tag, even one that reaches the HTML, does not run.

DKIM is a cryptographic signature a mail server adds to each outgoing message, verifiable through a public key published in DNS, proving the message was authorised by the signing domain and not altered in transit.

DMARC is the DNS policy that tells receivers what to do with mail that fails SPF and DKIM alignment against the visible From: domain, and where to send reports about who is sending as you.

HSTS is a response header (Strict-Transport-Security) that tells a browser to only ever reach your site over HTTPS for a set duration, so a later attempt to downgrade the connection to plain HTTP is refused by the browser itself.

HTTP status codes are the three-digit numbers a server returns with every response (200 OK, 404 Not Found, 500 Server Error), and read carefully they leak security-relevant information — whether an account exists, whether you are rate-limited, or whether the server just spilled a stack trace.

A JWT is a compact, URL-safe token made of three Base64url parts — a header, a JSON payload of claims, and a signature — that lets a server hand a client a set of verified facts (who you are, when it expires) it can check later without a database lookup.

SPF is a DNS TXT record that lists the servers allowed to send e-mail using your domain in the envelope sender, so a receiving server can reject mail from anywhere else.

TOTP is the algorithm behind the rotating six-digit code in Google Authenticator and similar apps — it hashes a shared secret together with the current 30-second time step so the phone and the server independently arrive at the same short-lived number.

An IOA describes what an attacker is doing rather than what they left behind — a sequence of actions such as "a document opens a shell that downloads and executes a file" — so it detects the technique regardless of which hash, IP or domain is used this time.

An IOC is a piece of forensic evidence — a file hash, an IP address, a domain, a registry key, a mutex — whose presence on a system or in traffic indicates that a known intrusion has occurred.

A Sigma rule is a detection written once, in a small YAML format, that describes what to look for in which kind of log — and is then converted into the query language of whatever SIEM you happen to run.

STIX is the standard JSON format for describing threat intelligence — indicators, malware, attack patterns and how they relate — and TAXII is the HTTPS protocol for publishing and pulling STIX between organisations and tools.

TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).

A Windows Event ID is the numeric code that identifies a type of log entry in the Windows Event Log — 4625 is a failed logon, 4688 is a new process — and knowing the handful that matter is what turns a firehose of events into detections you can actually write.

YARA is a pattern-matching language for describing files — you list the strings, bytes or regexes that characterise a piece of malware and a boolean condition over them, and the YARA engine flags any file that matches, which is how analysts hunt for a malware family across a fleet.

A CVE is a unique public identifier (like CVE-2021-44228) for one specific software vulnerability, so a bug, a scanner finding, a vendor advisory and a patch note can all point at the same thing without ambiguity.

CVSS is the industry formula that turns the intrinsic characteristics of a vulnerability — how it is reached, how hard it is, what it breaks — into a 0–10 severity score and a vector string that records how the score was derived.

EPSS is a daily-updated probability, from 0 to 1, that a given CVE will be exploited in the wild within the next 30 days — a likelihood score to set beside CVSS's severity score.

SSVC is a decision-tree method (from CISA and Carnegie Mellon) that turns a few yes/no questions about a vulnerability into one of four actions — Track, Track*, Attend or Act — instead of a single severity number.

C2 (Command and Control) is the channel an attacker uses to remotely control compromised hosts — send commands, pull data, push new tools — after the initial compromise.

The Cyber Kill Chain is a seven-stage model of an intrusion's lifecycle — Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives — published by Lockheed Martin in 2011 to frame where in the chain to break an attack.

A LOLBin (Living Off the Land Binary) is a legitimate, pre-installed system tool — certutil, mshta, rundll32 — that an attacker repurposes to download, execute or hide malicious activity, so nothing "new" ever touches disk.

OSINT is intelligence assembled entirely from publicly available sources — DNS and WHOIS records, certificate transparency logs, search engines, social media and breach data — used by attackers to map a target and by defenders to see the same exposure first.

Port scanning is the act of probing a host to learn which network ports are open and what service answers on each, so you can build a map of a target's attack surface — the reachable doors — before deciding which ones are worth pushing on.

Privilege escalation is gaining higher-level access than an attacker started with — from a regular user to an administrator (vertical), or from one regular user's access to another's (horizontal).

Prompt injection is an attack where text supplied to a language model — directly by a user or hidden inside content the model reads — overrides the developer's instructions, because the model cannot reliably tell its trusted instructions apart from untrusted data.

Red team attacks (or simulates attacking), blue team defends and detects, purple team is the deliberate practice of doing both together so the detection gap gets closed instead of just documented.

A reverse shell is a command shell where the compromised machine initiates the connection out to the attacker's listener, rather than the attacker connecting in — a design that neatly steps around inbound firewall rules, which is exactly why it is the default payload after a foothold.

AES-GCM is a symmetric encryption mode that both hides data and detects tampering in one step — it produces ciphertext plus an authentication tag, so decryption fails loudly if even one bit of the ciphertext or its associated data was altered.

bcrypt is a password-hashing algorithm designed to be slow on purpose, so that even if a database of hashes leaks, brute-forcing the original passwords is expensive at scale.

A cryptographic hash function turns any input into a fixed-length digest such that the same input always gives the same output, a tiny change gives a completely different output, and — for a secure one — you cannot work back from the digest to the input or find two inputs that share it.

An HMAC is a hash computed with a shared secret key mixed in, so it proves two things at once — the message was not altered, and it came from someone who holds the key — which is why webhooks and APIs sign their payloads with it.

PGP (Pretty Good Privacy, standardised as OpenPGP) lets you encrypt a message so only the intended recipient can read it, and/or sign a message so the recipient can verify it really came from you and was not altered.

An X.509 certificate is a signed document that binds a public key to an identity (a domain name) and is vouched for by a Certificate Authority, so a browser can trust that the key it is using to set up HTTPS really belongs to the site it is talking to.

DNS records are the entries that tell the internet how to resolve and treat a domain: A/AAAA map a name to an address, MX names the mail servers, TXT holds free text (SPF, DMARC, verification tokens), CNAME aliases one name to another, and NS delegates a zone.

SRI (Subresource Integrity) is an HTML attribute that lets the browser verify a script or stylesheet loaded from a third party — a CDN — has not been altered, by checking it against a cryptographic hash you embed in the tag.

A subdomain takeover happens when a DNS record — usually a CNAME — still points at a third-party service that is no longer claimed, letting anyone sign up for that service and serve their own content under your legitimate subdomain.

WHOIS is the lookup that shows who registered a domain, when, through which registrar and on which nameservers — today served over RDAP, its structured JSON successor, with registrant contact details mostly redacted since the GDPR.