Security terms, defined properly

Access decisions evaluated from attributes of the subject, resource, action and environment against policy rules (NIST SP 800-162).

The protocol (RFC 8555) that automates proving domain control and issuing certificates, used by Let's Encrypt and most CAs.

Kubernetes API server code or webhook that inspects, and can mutate or reject, every create or update request after authentication and authorisation.

A cipher mode that encrypts and authenticates in one step, and also authenticates extra unencrypted data such as headers.

The most widely deployed AEAD: AES in counter mode for encryption plus a GHASH polynomial MAC, specified in NIST SP 800-38D.

Desensitisation that sets in when analysts face more alerts than they can investigate, leading to rushed triage and missed real incidents.

Announcing the same IP prefix from many locations via BGP so each client is routed to the topologically nearest site.

A memory-hard password hashing function (RFC 9106), winner of the Password Hashing Competition and the current default choice.

Periodic outbound check-ins from malware to its command and control server, often detectable by regular timing and consistent size.

Fraud that uses a compromised or spoofed business mailbox to trick staff into paying fake invoices, changing bank details or sending data.

The total set of systems, data and users an attacker or failure can reach from one compromised component or credential.

An API that returns or changes an object by ID without checking the caller may access that specific object. OWASP API1:2023.

A tightly controlled emergency path to privileged access when normal authentication or approval systems are unavailable.

Public, append-only logs of every issued TLS certificate, so mis-issuance is detectable by anyone (RFC 6962).

An AEAD combining the ChaCha20 stream cipher with the Poly1305 MAC, specified in RFC 8439 and fast without AES hardware.

A documented record of who collected, handled, transferred and stored each piece of evidence, proving it was not altered.

A product category that bundles posture management, workload protection, entitlement analysis and IaC scanning into one cloud security platform.

A response header requiring every cross-origin subresource a page loads to opt in via CORS or CORP, or be loaded without credentials.

A response header that puts a page in its own browsing context group, cutting window references to cross-origin openers and popups.

A browser mechanism letting a server relax the same-origin policy so specific other origins can read its responses.

The ability to swap algorithms, key sizes or parameters without redesigning the system or breaking existing data.

Deleting data by destroying the key that encrypts it, so every copy, including backups, becomes unreadable.

A response header that tells the browser which scripts, styles, frames and connections a page may load, limiting the impact of XSS.

Tooling that continuously reads cloud control-plane configuration and flags resources that break policy, such as public buckets or open security groups.

Tricking a logged-in user's browser into sending a state-changing request to a site that trusts the browser's cookies.

Testing a running application from the outside by sending crafted requests and observing responses for signs of vulnerabilities.

Collecting, keeping and exposing only the personal data needed for a stated purpose, for no longer than needed.

Diverting traffic through high-capacity filtering infrastructure that drops attack packets and forwards only clean traffic to the origin.

Managing detection rules like software: version control, peer review, automated tests and CI/CD deployment to the SIEM.

An intrusion analysis model linking four features of every event: adversary, capability, infrastructure and victim.

A mathematical guarantee that a query's output barely changes whether or not any single person's data is included.

A scheme where the sending domain signs selected headers and the body of an email, with the public key published in DNS, defined in RFC 6376.

A DNS policy that requires SPF or DKIM to pass and align with the visible From domain, and tells receivers what to do on failure (RFC 7489).

Encoding data or command and control traffic inside DNS queries and responses to slip past controls that allow DNS outbound.

Extensions that sign DNS records so resolvers can verify answers came from the zone owner unmodified, via a chain of trust from the root.

An OAuth mechanism (RFC 9449) binding tokens to a client key pair, so a stolen access token cannot be replayed without the key.

A person's request, under GDPR Article 15 and similar laws, to receive a copy of the personal data an organisation holds about them.

Network traffic between systems inside a data centre or cloud environment, as opposed to north-south traffic entering or leaving it.

A Linux kernel facility that runs verified, sandboxed programs on kernel hooks, used for observability, networking and runtime security without kernel modules.

An endpoint agent and backend that record process, file, network and registry activity, detect malicious behaviour and allow remote response.

Adding context to an alert or observable, such as asset owner, geolocation, reputation or WHOIS data, so analysts can judge it quickly.

Encrypting data with a local data key, then encrypting that data key under a master key held in a KMS or HSM.

An alert that fires on activity that is not actually malicious; its counterpart, a false negative, is malicious activity that raised no alert.

A property where stealing a long-term key later does not let an attacker decrypt past sessions.

A forged Kerberos TGT signed with the domain's krbtgt key, letting an attacker impersonate any user with any group membership.

Recording encrypted traffic today in order to decrypt it once a cryptographically relevant quantum computer exists.

A key derivation function (RFC 5869) that extracts entropy from input key material and expands it into multiple independent keys.

A keyed MAC built from a hash function (RFC 2104, FIPS 198-1) that proves a message came from a key holder and was not altered.

A tamper-resistant device that generates, stores and uses keys internally so the key material cannot be extracted.

Combining a classical and a post-quantum key exchange so the session key stays secure unless both are broken.

Accessing another user's data by changing an identifier the application trusts without an authorisation check.

The session-token version of the AWS EC2 metadata service, requiring a PUT-issued token that most SSRF bugs cannot obtain.

Intel's confidential VM technology, running VMs as hardware-isolated trust domains that the hypervisor cannot read or tamper with.

An observable artefact, such as a file hash, IP, domain or URL, that indicates a system may have been compromised.

A TLS client fingerprint built from ClientHello fields, sorted to resist randomisation, used to identify client software regardless of IP.

A compact, URL-safe token of base64url JSON claims, signed (JWS) or encrypted (JWE), defined in RFC 7519.

A dataset property where every record is indistinguishable from at least k-1 others on its quasi-identifiers.

Requesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover service account passwords.

Replacing a cryptographic key with a new version on a schedule or after exposure, while old data and tokens stay verifiable.

Lockheed Martin's seven-phase model of an intrusion, from reconnaissance to actions on objectives, used to plan where to break an attack.

A service that stores keys in HSM-backed storage and performs cryptographic operations on request, so callers never see the key material.

Microsoft's pipe-based, read-only query language used in Sentinel, Defender XDR, Azure Data Explorer and Log Analytics.

Techniques an attacker uses to move from an initial foothold to other systems in the environment, typically with harvested credentials.

Giving each user, service and process only the permissions it needs, for only as long as it needs them.

Legitimate, signed system tools such as certutil, rundll32 and mshta that attackers abuse to download, execute or persist without dropping malware.

A Microsoft 365 mailbox audit action recording when mail items are read or synced, used to scope what an attacker saw.

Each boot stage hashes the next into TPM PCRs before running it, producing a record of exactly what booted.

Restricting traffic between individual workloads to explicitly allowed flows, rather than trusting everything inside a broad network zone.

A public knowledge base of adversary tactics and techniques observed in real intrusions, used as a shared vocabulary for detection and intel.

The NIST post-quantum signature standard (FIPS 204), derived from CRYSTALS-Dilithium.

The NIST post-quantum key encapsulation standard (FIPS 203), derived from CRYSTALS-Kyber and based on module lattices.

TLS where both client and server present certificates, so each side authenticates the other cryptographically.

Average time from an incident starting to its detection (MTTD), and from detection to containment or resolution (MTTR).

Serving many customers from shared infrastructure while guaranteeing that no tenant can read, modify or exhaust another tenant's data or resources.

Summary records of network conversations (5-tuple, byte and packet counts, timestamps) exported by routers, firewalls or cloud platforms.

A value that must be used only once in a given context, such as per key in an AEAD or per request in a replay check.

A delegated authorisation framework (RFC 6749) that lets a client obtain scoped access tokens to call an API on a user's behalf.

The server fetches a signed revocation status for its own certificate and sends it in the TLS handshake, sparing clients a lookup.

An identity layer on OAuth 2.0 that returns a signed ID token telling the client who the user is and how they authenticated.

A general-purpose policy engine that evaluates JSON input against rules written in Rego and returns a decision, decoupling policy from application code.

OWASP's ranked list of the most critical security risks in applications built on large language models.

Authenticating with a stolen NTLM password hash instead of the plaintext password, possible because NTLM uses the hash itself as the secret.

Phishing-resistant FIDO credentials: per-site key pairs stored on a device or synced by a platform, unlocked with biometrics or a PIN.

A TPM register that can only be extended, never set, accumulating a hash chain of everything measured during boot.

A secret added to password hashing and kept outside the database, so a stolen hash table cannot be cracked without it.

Using one known artefact to discover related ones, such as other domains on the same IP or certificate, to map adversary activity.

An OAuth extension (RFC 7636) that binds an authorisation code to the client that requested it, so a stolen code is useless.

The CAs, certificates, policies and revocation machinery that bind names to public keys so others can trust them.

Three Kubernetes pod hardening profiles (Privileged, Baseline, Restricted) enforced per namespace by the built-in Pod Security Admission controller.

Text that an LLM treats as instructions, overriding the developer's intent, whether typed by a user or hidden in content it reads.

Replacing direct identifiers with pseudonyms so data cannot be tied to a person without separately held additional information.

David Bianco's model ranking indicator types by how much pain it causes an attacker when defenders detect and deny them.

Malware or an intrusion campaign that encrypts victims' data and, increasingly, steals it first to extort payment.

Granting permissions to roles and assigning users to roles, rather than granting permissions to users directly.

Authorisation derived from a graph of relationships, such as 'user is member of team that owns folder that contains document'.

Issuing a new refresh token on every use and invalidating the old one, so reuse of a stolen token is detected.

A device or workload proving to a remote verifier, with hardware-signed evidence, what software and configuration it is running.

A unique random value stored with each password hash so identical passwords produce different hashes and precomputed tables fail.

A cookie attribute (Strict, Lax or None) controlling whether the browser sends the cookie on requests initiated by other sites.

An XML-based SSO standard (OASIS, 2005) where an identity provider sends a signed assertion about the user to a service provider.

Analysing source code or bytecode without running it to find vulnerable patterns such as injection sinks reached by untrusted input.

A machine-readable inventory of the components, versions and licences inside a piece of software, typically in SPDX or CycloneDX format.

Identifying third-party dependencies in a project and matching them against vulnerability and licence databases.

A REST and JSON standard (RFC 7643 and RFC 7644) for automatically provisioning and deprovisioning users and groups across systems.

Searching code, history, logs and artefacts for credentials such as API keys, tokens and private keys that should never have been committed.

A UEFI feature that only runs bootloaders and drivers signed by keys in the firmware's allowed database.

An infrastructure layer of proxies that handles service-to-service traffic, giving mTLS, identity, authorisation and telemetry without application changes.

An attack where the attacker plants a known session ID on the victim, then uses it after the victim logs in.

AMD's confidential VM technology: encrypted VM memory plus integrity protection against a malicious hypervisor, with signed attestation.

A platform that collects, normalises and stores security logs centrally, then runs searches, correlation rules and alerting over them.

A vendor-neutral YAML format for log-based detection rules that converts into SIEM query languages such as KQL, SPL and Elastic queries.

An open signing ecosystem that issues short-lived certificates bound to an OIDC identity and records every signature in a public transparency log.

Registering package names that AI coding tools hallucinate, so developers who install the suggested dependency get malware.

An OpenSSF framework of graded build integrity levels, centred on signed provenance that records how, where and from what an artefact was built.

Tooling that runs playbooks across security and IT systems to automate enrichment, triage and containment steps for alerts and incidents.

A DNS TXT record listing which servers may send mail using a domain in the SMTP envelope sender (MAIL FROM), defined in RFC 7208.

A CNCF standard for issuing short-lived, verifiable identities to workloads, as X.509 or JWT SVIDs, without static secrets.

Splunk's pipe-based search language for filtering, transforming and aggregating indexed events.

Making a server fetch a URL of the attacker's choosing, reaching internal services or cloud metadata the attacker cannot reach directly.

Requiring a stronger or fresher authentication only when a user attempts a sensitive action or the session looks risky.

OASIS standards for representing threat intelligence as JSON objects and relationships (STIX) and exchanging it over HTTPS APIs (TAXII).

A CSP source expression that trusts scripts loaded by already-trusted (nonced or hashed) scripts and ignores host allow-lists.

A denial of service attack that sends TCP SYNs, often from spoofed sources, to exhaust a server's half-open connection state.

A free Microsoft Sysinternals service that logs detailed process, network, file and registry activity to the Windows event log.

A hardware-isolated environment where code and data are protected from the OS, hypervisor and other software on the same machine.

Proactively searching telemetry for attacker activity that existing detections missed, usually starting from a testable hypothesis.

A FIRST standard of four sharing labels that tell recipients how far they may redistribute a piece of information.

Replacing sensitive values such as card numbers with surrogate tokens, keeping the real values only in a tightly controlled vault.

A six-digit code derived from a shared secret and the current 30-second time step (RFC 6238), as used by authenticator apps.

A small security chip or firmware module that holds device keys, records boot measurements in PCRs and seals secrets to platform state.

A browser API, enforced via CSP, that blocks strings from reaching DOM XSS sinks like innerHTML unless they pass through a vetted policy.

How an adversary operates: tactics are goals, techniques are methods to reach them, and procedures are the specific implementations seen.

Analytics that baseline normal behaviour for users, hosts and service accounts and flag statistically unusual activity.

Building software by prompting an AI and accepting its output largely without reading or understanding the code.

A layer 7 filter in front of web applications that inspects HTTP requests and blocks those matching attack signatures, anomalies or rate rules.

The W3C browser API for registering and using public key credentials, the web half of FIDO2 alongside CTAP2.

Letting a workload exchange a token from its own platform (CI, Kubernetes, another cloud) for short-lived cloud credentials, with no stored keys.

A vendor approach that correlates detections across endpoint, identity, email, cloud and network telemetry in one platform and response console.

Injecting script into a page so it runs in other users' browsers with the site's origin and privileges.

A pattern-matching language for identifying and classifying files or memory by strings, byte sequences and conditions.

A security model that grants access per request based on verified identity, device state and context, never on network location alone.

Remote access that brokers each user to specific applications after checking identity and device, replacing network-level VPN access.