48 — Cybersecurity Glossary and Cheat Sheet
Level: Reference · Time: ~10 min to skim, lifetime to use · Prerequisites: Lesson 47 — Your Career Path — From Zero to Hired
What this page is
This is the back matter of the course: the page you come back to. It is deliberately built as tables rather than prose, one accurate clause per term, so you can settle an argument, translate a report or prepare for an interview in a few minutes. Every term below is real and appears somewhere in Lessons 1 to 47. **Find your term, then follow the theme or the lesson reference for the depth. Where a term carries two meanings in this field, both are given, because that confusion is itself a common source of mistakes. The quick-reference tables near the end — ports, Windows event identifiers, Linux paths, suspicious file extensions, the attack-to-control index and a handful of daily commands — are the ones practitioners keep open on a second screen. If you arrived here by search rather than by reading in order, the closing note points you back to the course map.
Identity and access
| Term | Expansion or also called | Why it matters |
|---|---|---|
| AAA · authentication · authorisation | authentication, authorisation, accounting or auditing; proving who you are, then deciding what you may do | the three questions every access decision answers — do not confuse "logged in" with "allowed" |
| ACL | access control list | the per-object list of who may do what, and where accidental privilege hides |
| RBAC · ABAC | role-based, attribute-based access control | roles scale for people; attributes such as device, location and risk are how modern policies are written |
| least privilege | minimum access, for the minimum time | the one control that limits how far any single compromise spreads |
| IAM · IdP · SSO | identity and access management; identity provider; single sign-on | the system that issues and revokes access, the service that authenticates, and the convenience that concentrates risk in one account |
| MFA · FIDO2 · passkey | multi-factor authentication; the WebAuthn and CTAP standards; a phishing-resistant credential | a second factor defeats most credential attacks, and a passkey cannot be relayed by a phishing proxy |
| OAuth 2.0 · OIDC | delegated authorisation framework; OpenID Connect, the identity layer above it | the consent screens and tokens behind "sign in with…" — an over-permissive consent is a standing back door |
| PAM | privileged access management | vaulting, session recording and just-in-time elevation for administrative accounts |
| LDAP | Lightweight Directory Access Protocol | how directories are queried — including yours, by an attacker mapping the organisation |
| TGT · ticket | Kerberos ticket-granting ticket; service tickets | whoever holds a ticket holds an identity until it expires, so lifetimes and monitoring matter |
| session token · refresh token | the credential issued after login, and the one that renews it | changing a password is not enough if the session or refresh token survives |
| secrets management | a vault, not a configuration file | API keys and passwords in code, scripts and config files are the quietest credential leak |
| zero trust | never trust because of network location | assume the network is hostile and verify every request on its own merits |
Network and protocols
| Term | Expansion or also called | Why it matters |
|---|---|---|
| ARP · ARP spoofing | Address Resolution Protocol mapping IP to hardware address; answering falsely on another host's behalf | the classic local-network interception, defeated by dynamic ARP inspection and segmentation |
| DNS · DNSSEC · DHCP · subdomain takeover | name resolution; cryptographic signing of DNS answers; Dynamic Host Configuration Protocol; an abandoned record claimed by somebody else | most attacks begin or end at DNS, a rogue DHCP server can quietly redirect a whole network, and a forgotten record can point a trusted subdomain at anyone's infrastructure |
| DoH · DoT | DNS over HTTPS, DNS over TLS | encrypts name lookups — good for privacy, and it hides queries from your own monitoring |
| BGP | Border Gateway Protocol | how networks announce routes to each other; a hijack is rare and global when it happens |
| CIDR · subnet · FQDN | prefix notation such as /24; a logical network division; a fully qualified domain name |
the addressing vocabulary of segmentation, firewall rules and certificates |
| port · TCP · UDP · ICMP | the numbered service endpoint; connection-oriented and connectionless transport; the control-message protocol | what is listening is what can be attacked; TCP completes a handshake, UDP does not |
| HTTP · HTTPS | the web protocol, and the same over TLS | where nearly all inbound business traffic arrives, and where the web attacks of Lesson 10 live |
| IMAP · POP3 · SMTP | mailbox access protocols; mail transport | IMAP leaves mail on the server and auditable, POP3 often removes it, and SMTP is the transport attackers abuse |
| SSH · RDP · SMB | Secure Shell (22); Remote Desktop Protocol (3389); Server Message Block (445) | the three remote-access protocols you must be able to name, restrict and log |
| VLAN · VPN · NAC · NAT | virtual local area network; virtual private network; network access control; network address translation | segmentation, encrypted transport, admission control and address rewriting — none of which is authorisation on its own |
| WPA2 · WPA3 | the two Wi-Fi security standards | WPA3 removes WPA2's offline-cracking weakness; use enterprise authentication where you control the clients |
| LLMNR · UPnP | Link-Local Multicast Name Resolution; Universal Plug and Play | legacy convenience protocols that are pure attack surface: credential capture and automatic port forwarding |
| jitter | variation in packet arrival time | it breaks real-time traffic and is a useful baseline anomaly in network monitoring |
| C2 · beaconing · JA3 | command and control; the periodic call-home; a fingerprint of a TLS client handshake | the channel, its rhythm and the client fingerprint that betrays a compromised host |
| MAC | media access control address — and, in cryptography, message authentication code | two unrelated meanings: the hardware address in networking, a keyed integrity tag in cryptography |
Cryptography
| Term | Expansion or also called | Why it matters |
|---|---|---|
| AES · hashing · salt · encryption at rest and in transit | Advanced Encryption Standard; a one-way digest; random data added before hashing; the two states data can be in | the cipher behind encryption everywhere; hashes prove integrity, a salt makes precomputed tables useless, and at-rest encryption is what makes a stolen laptop a hardware loss |
| TLS · CA · PKI · certificate expiry | Transport Layer Security; certificate authority; public key infrastructure; validity dates and revocation | the padlock secures the connection rather than proving the site honest, and an expired certificate takes a service down as surely as an attack |
| HSM · TPM · KMS | hardware security module; trusted platform module; cloud key management service | where keys should live, rather than beside the data they protect |
Attacks and techniques
| Term | Expansion or also called | Why it matters |
|---|---|---|
| MITRE · ATT&CK · TTP · IOC | the non-profit behind the knowledge bases; the catalogue of adversary tactics and techniques; tactics, techniques and procedures; an indicator of compromise | the shared language of detection, hunting and coverage measurement; indicators are useful and perishable |
| APT | advanced persistent threat | a well-resourced, patient actor — "persistent" is the word that matters, not "advanced" |
| phishing · spear phishing | bulk fraudulent messages; the same aimed at a named person | the entry point of most incidents, and the one your staff can most affect |
| CVE · CWE | Common Vulnerabilities and Exposures identifier; Common Weakness Enumeration category | the ID of a specific flaw, and the class of mistake it belongs to |
| vulnerability · exploit · ZeroLogon | a weakness that can be abused; the code or technique that abuses it; CVE-2020-1472, a cryptographic flaw in Netlogon | patching removes the first, toolkits keep the second for years, and ZeroLogon let one message take over a domain controller |
| brute force · spraying · credential stuffing | guessing many passwords; one password across many accounts; replaying credentials leaked elsewhere | spraying and stuffing both stay under lockout thresholds, so only a second factor and monitoring help |
| MITM | man in the middle | interception anywhere on the path, which is why TLS and segmentation travel together |
| lateral movement · LOLBin | moving from one compromised host to another; a living-off-the-land binary | the phase where a single ticket becomes an organisation-wide incident, often using tools you already own |
| malware · ransomware | malicious software; malware that encrypts data and demands payment | ransomware is usually theft plus encryption, so assume exfiltration even when you only see encryption |
| botnet · DDoS | a network of compromised machines; a distributed denial of service built from them | availability attacks are absorbed upstream by providers, not by the victim's firewall |
| OSINT | open-source intelligence | publicly available information, including your own exposure — which is where reconnaissance starts |
| OWASP Top 10 | the Open Web Application Security Project's list of the most serious web application risks | the standard shortlist for prioritising web fixes; check OWASP for the current edition |
| SQL injection · XXE · SSRF | injecting database commands through input; XML external entity; server-side request forgery | the server-side abuse family: a class that should be extinct, kept alive by unescaped input and over-privileged services |
| XSS · CSRF · clickjacking · CORS | script injection into a page; forging a request the user did not intend; tricking a click; cross-origin resource sharing and its misconfiguration | the browser-side family, defeated by output encoding, token and session design and strict origin policy |
| BOLA · IDOR | broken object level authorisation; insecure direct object reference | the most common API flaw: the request is authorised, but the object belongs to somebody else |
Defences and controls
| Term | Expansion or also called | Why it matters |
|---|---|---|
| CIA triad | confidentiality, integrity, availability | the three properties every control in this course exists to protect, and the reason "secure" is not a single thing |
| firewall | the device or host rule set that permits or denies traffic | the boundary control, and its value lies in the rules nobody has reviewed for two years |
| IDS · IPS · Suricata · Zeek · honeypot | intrusion detection and prevention systems; the open-source network detection engine and network security monitor; a decoy built to be attacked | detection alerts and prevention blocks need tuning; a honeypot is high-signal and nearly noise-free |
| HIDS · FIM · AIDE | host-based intrusion detection; file integrity monitoring; the Advanced Intrusion Detection Environment | host-level evidence that something changed when nothing else fires |
| EDR · EPP · XDR | endpoint detection and response; endpoint protection platform; extended detection and response | from antivirus to behaviour, across endpoint, identity and cloud telemetry |
| WAF | web application firewall | a compensating control for a web application you cannot fix today, never a substitute for fixing it |
| DLP | data loss prevention | stops sensitive data leaving; valued where it is proportionate and explained, resented where it is not |
| backup · BCP · RPO · RTO | a restorable copy; business continuity plan; recovery point objective; recovery time objective | RPO and RTO decide the design — how much data you may lose and how long you may be down |
| patch · EOL | applying a vendor fix; end of life, when fixes stop | most successful intrusions use a known flaw with an available fix, and unsupported software never gets one |
| SELinux | Security-Enhanced Linux | mandatory access control that limits what a compromised process can do, even as root |
| SPF · DKIM · DMARC | email sender authentication records, and the policy that ties them together | the trio that makes domain spoofing hard, and the cheapest email protection available |
| CIS Benchmark · CIS Controls | hardening configuration baselines; the prioritised control list of 18 groups, whose first Implementation Group holds roughly 56 safeguards | the pragmatic checklist this course is built on: start with IG1, use the benchmarks as configuration targets |
| penetration test · DAST | an authorised, scoped attempt to breach a system; dynamic application security testing | a test is a point-in-time measurement with a report, not a control, and DAST automates the easy half |
| SBOM | software bill of materials | the ingredient list for your software, which is how you answer "are we affected?" in an afternoon rather than a month |
Operations and governance
| Term | Expansion or also called | Why it matters |
|---|---|---|
| SIEM · UEBA · SOAR | security information and event management; user and entity behaviour analytics; security orchestration, automation and response | where logs are correlated and alerts born, baselines added, and the repeatable parts of triage automated |
| CEF · Sigma | the Common Event Format for logs; a vendor-neutral format for detection rules | how detection logic travels between tools and teams instead of being rewritten for each |
| SOC · SOC 2 | a security operations centre — and, separately, the AICPA attestation on system and organisation controls, Type I at a point in time or Type II over a period | one is a team that watches, the other is an audit report your customers may ask for; the same letters mislead constantly |
| incident · IR · MTTR | a confirmed or suspected compromise with business impact; incident response; mean time to repair, respond or remediate | the difference between a bad day and a closure is a rehearsed process — and MTTR means three different things, so define which one you report |
| threat hunting · threat modelling | hypothesis-driven searching for what detection missed; structured thinking about how a design can be attacked | one finds what got in, the other prevents a whole class of getting in |
| risk · residual risk | the combination of likelihood and impact; what remains after your controls | you decide about residual risk, never inherent risk, and every rating needs a stated scale |
| GRC · COBIT | governance, risk and compliance; ISACA's framework for governing enterprise IT | the vocabulary that gets security funded, and the structure that keeps decisions alive |
| NIST CSF | the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, Recover — with Govern added in the 2024 revision | a programme structure you can adopt without buying a certificate |
| ISO 27001 | the certifiable international standard for an information security management system | a customer-facing credential with a real cost in time, evidence and audit effort |
| PCI DSS | the Payment Card Industry Data Security Standard, at version 4.x | the obligation that applies if you store, process or transmit cardholder data |
| GDPR · PII · NIS2 | the EU General Data Protection Regulation; personally identifiable information; the EU directive raising obligations for essential and important entities | obligations, not suggestions: know what you hold and why, and expect reporting deadlines measured in hours and days |
| CISA · CISO | the US Cybersecurity and Infrastructure Security Agency, which publishes the Known Exploited Vulnerabilities catalogue — and, separately, ISACA's Certified Information Systems Auditor; plus the chief information security officer who owns the risk | three different things sharing one acronym class, which is exactly how conversations go wrong |
| CVSS · EPSS · KEV | Common Vulnerability Scoring System; Exploit Prediction Scoring System; the Known Exploited Vulnerabilities catalogue | severity, likelihood of exploitation and confirmed exploitation in the wild — prioritise with all three |
| blue team · red team · purple team | defenders; authorised attackers; the collaboration that turns attacks into detections | purple is a practice, not a department: the point is that defenders get measurably better |
| STIX · TAXII | Structured Threat Information Expression; Trusted Automated Exchange of Intelligence Information | the formats and transport for sharing threat intelligence between organisations and tools |
| MSP · IoT · BYOD | managed service provider; internet-of-things devices; bring your own device | where many small organisations' security actually happens, and the two categories of unmanaged endpoint that keep arriving |
Cloud, containers and the modern estate
| Term | Expansion or also called | Why it matters |
|---|---|---|
| SASE | Secure Access Service Edge | networking and security delivered as one cloud service, including zero-trust network access — how remote work is secured now |
| container escape | breaking out of a container onto its host | the reason containers are not a security boundary: run unprivileged, scan images, patch, monitor the runtime |
| shared responsibility · cloud posture · infrastructure as code | the split between what the provider secures and what you secure; configuration and permission review; describing infrastructure in versioned files | a provider secures the platform while identity, configuration and data remain yours; most cloud incidents are misconfiguration, and a key committed to a repository is still a key you must rotate |
Ports to know
| Port | Service | Why it matters |
|---|---|---|
| 22/TCP | SSH | remote administration of almost everything; keep it key-only and reachable from few places |
| 25, 587/TCP | SMTP, submission | mail transport and authenticated sending; misconfigured relays produce blocklists and spoofed mail |
| 53/UDP, TCP | DNS | resolution, and zone transfer; exposed publicly it is abused for amplification and tunnelling |
| 88, 389, 636/TCP | Kerberos; LDAP, LDAPS | directory authentication and queries — the protocols behind the ticket attacks of Lesson 13 |
| 135, 137–139, 445, 5985, 5986/TCP | Windows RPC, NetBIOS, SMB, WinRM | legacy services, file sharing and remote management; block them at every network boundary and log administrative paths |
| 443/TCP | HTTPS | where nearly all inbound business traffic lands, and therefore where your applications must be sound |
| 3306, 5432/TCP | MySQL, PostgreSQL | databases that should never be reachable from the internet, without exception |
| 3389/TCP | RDP | remote desktop and the most common ransomware door: gateway, second factor, no direct exposure |
| 514/UDP | syslog | log shipping, unauthenticated by default — keep it inside a trusted segment |
Windows event identifiers worth knowing
| Event ID | What it records | Why it matters |
|---|---|---|
| 4624 · 4625 | a successful logon; a failed logon | the payload of credential abuse, and the noise of brute force and spraying in aggregate |
| 4648 · 4672 | a logon using explicit credentials; special privileges assigned to a new logon | one process running as another user, and somebody logging in with administrative rights |
| 4662 | an operation on a directory object | DCSync appears here as replication access from something that is not a domain controller |
| 4688 · 4104 | a process was created; PowerShell script block logging | execution records, only as good as the audit policy you enabled |
| 4720 · 4728 · 4732 · 4756 | a user account was created; a member was added to a global, local or universal security group | persistence, fabricated identities, and how new administrators arrive |
| 4768 · 4769 · 4771 · 4776 | Kerberos TGT requested, service ticket requested, pre-authentication failed, and NTLM credential validation | roasting attacks, ticket abuse, Kerberos-side guessing, and the NTLM use that makes stolen hashes matter |
| 1102 · 104 | the audit log was cleared, in the Security and System logs respectively | almost never legitimate |
| 7045 | a service was installed | the most common persistence mechanism, and often the attacker's own tooling |
Linux paths worth knowing
| Path | What lives there | Why it matters |
|---|---|---|
| /etc/passwd · /etc/shadow | accounts and their password hashes | a new account or a modified hash is persistence |
| /etc/sudoers · /etc/sudoers.d/ | who may elevate, and how | a single line here is equivalent to full control |
| /etc/ssh/sshd_config · ~/.ssh/authorized_keys | SSH server configuration, and who may log in with which key | an added key is a silent, password-free back door |
| /var/log/auth.log · /var/log/secure · /var/log/audit/audit.log | authentication events on Debian-family and RHEL-family systems, and auditd's execution and file-access records | the first place to look for brute force and successful logins, then for process-level evidence if auditing was configured |
| /etc/cron* · /etc/systemd/system/ · /tmp · /dev/shm | scheduled jobs, service definitions, and world-writable temporary space | the quiet persistence points, and where tools are staged to run from memory |
File extensions worth attention in triage
| Extension | What it usually is | Why it matters |
|---|---|---|
| .exe · .dll · .scr · .ps1 · .bat · .cmd · .vbs · .js · .hta · .lnk | Windows executables, libraries, scripts and shortcuts | the ordinary carrier for execution; a shortcut is not an innocent file |
| .docm · .xlsm · .pptm · .one · .url · .htm · .html | macro-enabled Office documents, notebooks, shortcuts and web content | the usual email-borne delivery, including HTML smuggling that builds a file in the browser |
| .zip · .rar · .7z · .iso · .img | archives and disk images | archives hide content from inspection, and a password-protected one is deliberate evasion |
| .php · .jsp · .aspx | server-side web scripts | a small file with one of these in an upload directory is what a web shell looks like |
| .pem · .pfx · .key · .kdbx · .sql · .bak · .csv | keys, certificate bundles, password databases, database exports and backups | credentials found where they should not be — and often the actual target of theft |
The index: attack class to control to lesson
| Attack class | The control that answers it | Lesson |
|---|---|---|
| Phishing and business email compromise | SPF, DKIM and DMARC, second factors, awareness, the callback rule | 12, 45 |
| Credential theft, takeover and directory privilege abuse | MFA and passkeys, conditional access, session revocation, tiered administration, unique local admin passwords | 13, 20, 45 |
| Ransomware and double extortion | tested offline or immutable backups, isolation procedure, allowlisting, egress monitoring | 11, 21, 45 |
| Exploitation of a known vulnerability | patch cadence, exposure reduction, vulnerability management with CVSS, EPSS and KEV | 17, 27 |
| Web application attacks | input validation and secure development, WAF, session design, DAST | 3, 10 |
| Network interception and wireless attacks | segmentation, TLS, dynamic ARP inspection, DHCP snooping, WPA3 or WPA2-Enterprise | 9, 15, 18 |
| Supply chain and third-party risk | supplier governance and contract clauses, least-privilege integrations, SBOM | 14, 46 |
| Insider and departing-employee theft | joiner-mover-leaver, least privilege, logging, proportionate DLP, preserve before confronting | 14, 20, 45 |
| Cloud misconfiguration and identity abuse | least privilege, posture review, cloud logging, workload and container hardening | 15, 36 |
| Denial of service and outages | provider absorption and filtering, rate limiting, RTO and RPO planning | 9, 46 |
| An intrusion nobody noticed | central logging, detection engineering, hunting, and a rehearsed playbook | 22, 23, 26, 45 |
Everyday defensive commands
| Command | What it gives you |
|---|---|
ss -tulpn · ss -tanp state established |
every listening port with the process behind it, and who this host is talking to right now |
ps -eo pid,ppid,user,lstart,cmd --forest |
the process tree with start times; odd parents and recent starts stand out |
grep -iE -e "failed password" -e "invalid user" /var/log/auth.log |
authentication failures on a Linux host (/var/log/secure on RHEL-family systems) |
sudo ausearch -m execve -ts today |
what actually executed today, from auditd, if auditing was configured |
sudo tcpdump -ni any -c 500 -w /tmp/capture.pcap |
capture live traffic for later analysis in Wireshark or Zeek |
suricata -r /tmp/capture.pcap -l /tmp/out |
replay a capture through an IDS and get alerts for traffic you already hold |
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 100 |
failed logons on Windows over PowerShell; change the identifier for any event above |
[!TIP] Memorise two of these outright:
ss -tulpnon Linux andnetstat -anoon Windows. Knowing what is listening, and which process started it, answers the first question of almost every host investigation.
The five rules of this course
- Authorisation. Only ever test, scan or break systems you own or have written, scoped permission to touch.
- Patch and second factors first. The two controls with the best return, and the two left undone longest.
- Backups decide the outcome. Tested, offline or immutable copies turn a company-ending event into a bad week.
- You cannot detect what you do not log. Centralised logs, with someone or something actually reading them, are what turn a breach into a contained incident.
- Least privilege, assume breach. Give the minimum access, then build and monitor as though someone is already inside.
Key takeaways
- Every term here is one line because one line is what you need under pressure. Depth lives in the lesson, not in the glossary.
- The quick-reference tables are the working part of this page — ports, event identifiers, paths, extensions and the attack-to-control index.
- Use the index as your way back in. Take an attack class, read the control, then read the lesson; it is the shortest route from a symptom to the answer.
Check yourself
- Without scrolling up: what does event ID 4769 record, and which attack does it reveal in bulk?
- Which single control answers attack class after attack class in the index table, and why does it appear so often?
- Name three terms on this page that carry two different meanings in this field, and give both meanings for each.
If you arrived here by search rather than by reading in order, start at the course map and follow the lessons from the beginning — the glossary will make far more sense with the foundations underneath it.