Look it up in seconds

An IEEE standard for port-based network access control that authenticates devices before allowing them onto a wired or wireless network, often paired with RADIUS.

A framework that verifies identity (authentication), determines permitted actions (authorization), and records activity (accounting) for both users and devices.

A policy that defines how employees may and may not use organizational systems, networks, and data, setting expectations and consequences.

A Zero Trust concept where the level of authentication required adjusts dynamically based on contextual risk signals such as location, device posture, and behavior.

A physical isolation measure in which a system or network is completely disconnected from unsecured networks, including the internet. It is used to protect highly sensitive or critical systems from remote attacks.

The expected monetary loss from a risk over a year, calculated by multiplying the single loss expectancy by the annualized rate of occurrence.

The estimated number of times a specific risk event is expected to occur within a single year.

An encryption method that uses a mathematically linked public and private key pair, where data encrypted with one key can only be decrypted with the other. RSA and ECC are examples.

The total set of points where an unauthorized user could attempt to enter or extract data from an environment; reducing it lowers exposure to attack.

The path or method a threat actor uses to gain unauthorized access to a system, such as email, removable media, unsecured networks, or supply chains.

A formal declaration or confirmation, often by an independent party, that controls or compliance requirements have been verified and are in place.

An access model that makes access decisions dynamically by evaluating attributes of the user, resource, action, and environment against policy.

A distributed, append-only ledger in which records are cryptographically linked across many nodes, making the data tamper-evident and resistant to unauthorized change.

A flaw where a program writes more data to a memory buffer than it can hold, overwriting adjacent memory and potentially allowing arbitrary code execution.

A targeted attack in which an adversary compromises or impersonates a legitimate business email account, often that of an executive, to trick employees into transferring funds or sensitive data. It relies on social engineering and authority rather than malware.

An assessment that identifies critical business functions and the operational and financial effects of their disruption, informing recovery priorities and objectives.

A contract that defines the terms, responsibilities, profit sharing, and expectations between organizations entering into a business partnership.

A trusted entity that issues, signs, and vouches for the validity of digital certificates, binding a public key to a verified identity.

A published list maintained by a certificate authority of certificates that have been revoked before their scheduled expiration and should no longer be trusted.

A message generated by an applicant containing their public key and identifying information, submitted to a certificate authority to request a signed certificate.

The documented, unbroken record of who collected, handled, and controlled evidence and when, preserving its integrity and admissibility.

The formal process for requesting, reviewing, approving, and documenting modifications to systems and configurations to minimize the risk of unintended disruption. It typically involves approval workflows, impact analysis, backout plans, and maintenance windows.

The core information security model consisting of Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access when needed).

A security enforcement point placed between users and cloud services to provide visibility, enforce policy, and protect data across sanctioned and unsanctioned cloud applications. It addresses areas such as access control, data loss prevention, and threat protection.

Grouping multiple servers so they act as a single system, providing fault tolerance and continued service if one node in the cluster fails.

A basic alternate facility providing space and utilities but no preinstalled hardware or data, requiring the most time to become operational at the lowest cost.

A standardized identifier and public catalog entry for a specific, publicly disclosed security vulnerability, enabling consistent reference across tools and vendors.

An open framework that assigns a numerical severity score from 0 to 10 to a vulnerability based on its characteristics and potential impact.

An alternative control put in place when a primary control cannot be implemented, providing a comparable level of protection.

A virtualization method that packages an application with its dependencies into an isolated, lightweight container that shares the host operating system kernel. Containers are portable and efficient but require securing the shared kernel and images.

In Zero Trust, the logical layer that makes and manages access decisions, including the policy engine, policy administrator, and supporting functions like identity governance.

A control that restores systems or limits damage after an incident occurs, such as restoring from backup or applying a patch to remediate a vulnerability.

A web attack that tricks an authenticated user's browser into submitting an unwanted request to a site where they are logged in, performing actions without their consent. It exploits the trust a site places in the user's session.

A web vulnerability that lets an attacker inject malicious scripts into pages viewed by other users, enabling session theft, defacement, or redirection.

Data that is stored on a device or medium such as a disk, database, or backup, typically protected through encryption and access controls.

The entity that determines the purposes and means of processing personal data and bears primary responsibility for its lawful handling.

Data that is actively moving across a network between systems, typically protected with transport encryption such as TLS or IPSec.

Data that is currently being processed in memory or by an application, protected through measures such as access controls and confidential computing.

A set of tools and policies that detect and prevent unauthorized transmission or exfiltration of sensitive data outside the organization.

Obscuring portions of sensitive data, such as showing only the last four digits of a card number, so the data remains usable while protecting the full value.

In Zero Trust, the layer where actual data and connections move between subjects and resources, governed in real time by policy enforcement points.

An entity that processes personal data on behalf of and under the instructions of the data controller.

A policy that defines how long different types of data must be kept and when they should be securely disposed of, balancing legal and business needs.

The principle that data is subject to the laws and regulations of the country in which it is physically stored or collected.

A layered security strategy that uses multiple overlapping controls so that if one safeguard fails, others continue to protect the asset.

An attack that overwhelms a system, service, or network with excessive requests or malformed traffic to make it unavailable to legitimate users. A distributed version (DDoS) launches the attack simultaneously from many compromised hosts.

A control that identifies and alerts on a security event after or while it happens, such as an intrusion detection system, log review, or security camera footage review.

A control intended to discourage a threat actor from attempting an attack, such as warning banners, visible cameras, or signage.

A value created by encrypting a hash of a message with the sender's private key, providing integrity, authentication, and non-repudiation when verified with the sender's public key.

A control that guides or mandates behavior through policies, procedures, standards, or instructions to direct how security should be carried out.

An attack that manipulates file path input, often using sequences like ../, to access files and directories outside the intended web root. It can expose configuration files, credentials, and other sensitive data.

An access model in which the owner of a resource decides who may access it and what permissions they have.

The ongoing reasonable effort and actions an organization takes to protect its assets and meet its obligations, demonstrating responsible stewardship.

The thorough investigation and assessment performed to understand risks before entering an agreement, acquisition, or relationship.

The process of identifying, collecting, and producing electronically stored information for use as evidence in legal proceedings.

An asymmetric encryption approach based on the mathematics of elliptic curves that provides strong security with much smaller key sizes than RSA. Its efficiency makes it well suited for mobile and low-power devices.

A solution that continuously monitors endpoint activity to detect, investigate, and respond to threats, providing visibility and remediation beyond traditional antivirus.

An evolution of EDR that correlates threat data across multiple layers such as endpoints, network, email, and cloud for unified detection and response.

A flexible authentication framework used within 802.1X that supports multiple methods such as certificates, tokens, and passwords for verifying network access.

A failure to alert on activity that is actually malicious, allowing a real threat to go undetected.

An alert that incorrectly indicates malicious activity when the behavior is actually benign, leading to wasted investigation effort if frequent.

An arrangement that allows users from one trusted domain or organization to access resources in another using a shared, agreed-upon identity.

A control that detects unauthorized changes to critical files and system configurations by comparing them against a known-good baseline.

Malware that operates entirely in memory by abusing legitimate system tools and processes, leaving little or no trace on disk. This makes it difficult for traditional signature-based antivirus to detect.

An evaluation that compares an organization's current security posture against a desired standard or framework to identify deficiencies that need remediation.

The framework of policies, roles, and processes through which leadership directs and oversees an organization's security program to align it with business objectives.

A tamper-resistant physical device used to generate, store, and manage cryptographic keys and perform encryption operations at scale, often in enterprise or PKI environments.

A one-way function that converts data of any size into a fixed-length value used to verify integrity; the same input always produces the same output and the original cannot be derived from it.

A design approach that keeps systems and services operational with minimal downtime through redundancy, failover, and the elimination of single points of failure.

A decoy system intentionally made to look vulnerable in order to attract attackers, study their techniques, and divert them from real assets. A connected group of honeypots forming a fake network is called a honeynet.

A fully equipped, continuously running alternate facility that can take over operations almost immediately after a disaster, at the highest cost.

The set of policies and technologies for managing digital identities and controlling what resources each identity is permitted to access throughout its lifecycle.

An area of a network where traffic is allowed to move freely after an entity has been authenticated at a policy enforcement point, minimizing repeated checks within that boundary.

The structured phases used to manage a security incident: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

An observable artifact such as a malicious IP, file hash, or unusual log entry that signals a system may have been breached.

The practice of provisioning and managing infrastructure through machine-readable configuration files rather than manual processes. It promotes consistency, repeatability, and version control while reducing configuration drift.

A risk that originates from someone with legitimate access, such as an employee or contractor, who intentionally or accidentally causes harm to the organization.

A monitoring system that analyzes network or host activity for signs of malicious behavior and generates alerts, but does not block traffic on its own.

A system that detects malicious activity like an IDS but is placed inline so it can actively block or drop offending traffic in real time.

A suite of protocols that secures IP communications by authenticating and encrypting packets, commonly used to build site-to-site and remote-access VPNs.

A technique that records changes to data in a log before committing them, allowing a system to recover to a consistent state after a failure.

A hardened intermediary host that administrators connect through to reach and manage devices in a more secure or segmented network zone. Also called a jump box.

A model that grants elevated privileges only for the limited time they are needed and revokes them automatically afterward to reduce standing risk.

A practice in which copies of cryptographic keys are stored with a trusted third party so they can be recovered if the original is lost or legally required.

A technique that strengthens weak keys or passwords by repeatedly applying a hashing or derivation function, increasing the computational cost of brute-force attacks.

Software or hardware that secretly records a user's keystrokes to capture credentials, messages, and other sensitive input.

The principle that users, processes, and systems should be granted only the minimum access and permissions necessary to perform their function.

A formal process that preserves all relevant data and prevents its deletion when litigation or an investigation is reasonably anticipated.

A protocol for accessing and managing directory information such as users, groups, and resources, commonly used for centralized authentication.

Distributing incoming network or application traffic across multiple servers to improve performance, prevent overload, and provide redundancy.

Malicious code embedded in a system that lies dormant until a specific condition or time triggers it to execute its harmful payload.

A control category consisting of administrative oversight mechanisms such as policies, risk assessments, and security planning. Also called an administrative control.

An access model in which a central authority assigns access based on classification labels and clearances, and users cannot change permissions themselves.

An overarching contract that establishes the general terms governing the relationship between parties, under which future statements of work are issued.

The average elapsed time between inherent failures of a repairable system, used as a measure of reliability.

The average time required to diagnose and restore a failed system or component back to normal operation.

A more formal document than an MOU that outlines the specific responsibilities and commitments of each party, and may be legally binding.

A non-binding document that expresses a mutual agreement and broad intentions between parties to work together toward a common goal.

A centralized solution for enforcing security policies, configurations, and applications across an organization's mobile devices. It enables capabilities such as remote wipe, encryption enforcement, and separation of corporate and personal data.

Authentication that requires two or more independent factors from different categories, such as something you know, have, and are, to verify identity.

A highly resourced and sophisticated threat actor sponsored by a government, often pursuing espionage or disruption and associated with advanced persistent threats.

A solution that enforces policy on devices attempting to join a network, checking posture and identity before granting, limiting, or denying access.

A firewall that adds deep packet inspection, application awareness, and integrated intrusion prevention on top of traditional port and protocol filtering.

A legally binding contract in which parties agree to keep specified confidential information private and not disclose it to unauthorized third parties.

Assurance that a party cannot deny the authenticity of an action or message they performed, commonly provided through digital signatures and audit logging.

An open authorization framework that lets an application access resources on a user's behalf using tokens, without exposing the user's credentials.

The practice of deliberately making data or code difficult to understand in order to conceal its meaning or hide its true purpose. It is used both defensively to protect intellectual property and offensively by malware to evade detection.

An attack in which a threat actor secretly positions themselves between two communicating parties to intercept, read, or alter the traffic. Formerly called man-in-the-middle.

A protocol that lets a client query a certificate authority in real time to check whether a single certificate is valid or revoked, offering a faster alternative to a CRL.

A control category carried out by people in day-to-day operations, such as security guards, awareness training, and configuration management.

The systematic process of identifying, testing, and deploying updates to operating systems and applications to remediate vulnerabilities and bugs. Timely patching is a primary defense against exploitation of known flaws.

A property of key exchange that generates a unique session key for each session, so compromise of a long-term private key does not expose past communications.

An attack that redirects users from a legitimate website to a fraudulent one without their knowledge, typically by poisoning a DNS cache or altering a local hosts file. Unlike phishing, it can compromise users even when they type the correct address.

A social engineering attack that uses fraudulent email to trick recipients into revealing credentials, clicking malicious links, or opening malware-laden attachments.

A control category that protects tangible assets and facilities, such as locks, fences, bollards, badge readers, and lighting.

A documented, step-by-step set of procedures that defines how to respond to a specific type of security event or incident in a consistent way.

The control-plane component that evaluates access requests against policy and tells the enforcement point whether to grant or deny them. It is typically split into a policy engine and policy administrator.

The component in a Zero Trust architecture that sits in the data plane and actively allows, denies, or terminates a connection based on the decision it receives from the policy decision point.

A social engineering technique in which the attacker invents a believable scenario or fabricated identity to gain the victim's trust and obtain information.

A control that stops a security incident before it occurs, such as a firewall rule, access control list, or security awareness training.

Exploiting a flaw or misconfiguration to gain higher-level permissions than were originally granted, either vertically to admin rights or horizontally to another user's access.

A solution that secures, controls, and monitors elevated accounts and credentials, often using vaulting, session recording, and just-in-time access.

An intermediary that forwards client requests to other servers, providing benefits such as caching, content filtering, anonymity, and access control.

The framework of hardware, software, policies, and procedures used to create, manage, distribute, and revoke digital certificates and public-private key pairs.

A risk assessment approach that uses subjective ratings such as high, medium, and low to prioritize risks based on likelihood and impact.

A risk assessment approach that assigns objective numerical and monetary values to risks using metrics such as SLE, ARO, and ALE.

A vulnerability that arises when the outcome of a process depends on the timing of events, such as a time-of-check to time-of-use (TOCTOU) flaw that can be exploited.

A networking protocol that provides centralized authentication, authorization, and accounting for users connecting to a network service. It is widely used for remote access, VPN, and 802.1X wireless authentication.

Malware that encrypts a victim's data or locks their system and demands payment, often in cryptocurrency, in exchange for restoring access.

The maximum acceptable amount of data loss measured in time, defining how far back recovery must reach and how frequently backups must occur.

The maximum acceptable amount of time a system or process can be down after an incident before causing unacceptable harm to the organization.

An attack in which a valid data transmission, such as a captured authentication token or session credential, is maliciously retransmitted to impersonate a user or repeat a transaction. Timestamps, nonces, and session tokens help defend against it.

A privacy right that allows individuals to request the deletion of their personal data when there is no compelling reason to continue retaining it.

The broad amount and type of risk an organization is willing to pursue or accept in order to meet its strategic objectives.

A centralized document that records identified risks along with their likelihood, impact, owners, and treatment plans for ongoing tracking.

The acceptable level of variation around a specific risk that an organization is prepared to withstand before taking action.

An access model that grants permissions based on a user's assigned role or job function rather than to individuals directly.

A structured investigation conducted after an incident to identify the underlying cause so that effective corrective action can prevent recurrence.

A hardware or software component that is inherently trusted and serves as the secure foundation from which a chain of trust for cryptographic operations is established.

Malware designed to gain and conceal privileged access to a system, hiding its own presence and that of other malicious software from detection tools.

Adding a unique random value to a password before hashing it, which defeats precomputed rainbow-table attacks and ensures identical passwords produce different hashes.

A buffer network segment that sits between the internet and the internal network to host public-facing services while isolating them from internal systems. Formerly called a DMZ.

Software-defined wide area networking that uses software to intelligently route traffic across multiple connection types, improving performance and lowering cost between sites.

A cloud-delivered model that converges networking and security functions such as SD-WAN, secure web gateway, and Zero Trust access into a single service.

An isolated, hardware-protected area of a processor used to store and process highly sensitive data such as cryptographic keys separate from the main operating system.

An XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider to enable SSO.

A suite of standards that lets security tools automatically check systems for vulnerabilities, misconfigurations, and policy compliance in a consistent format.

A platform that aggregates, correlates, and analyzes log and event data from across an environment to support real-time monitoring, alerting, and investigation.

Technology that automates and coordinates security workflows and incident response actions using predefined playbooks to reduce manual effort and response time.

A certificate signed with its own private key rather than by a trusted certificate authority, meaning no external party vouches for it. It is suitable for internal testing but triggers browser trust warnings on public sites.

A control that divides critical tasks among multiple people so that no single individual can complete a sensitive process alone, reducing fraud and error.

A cloud computing model in which the provider dynamically manages the underlying servers and runs code in response to events, billing only for actual execution. Developers focus on functions while offloading infrastructure management to the provider.

A contract that defines the specific level of service, performance metrics, and responsibilities expected between a provider and a customer.

Hardware, software, or cloud services used within an organization without the knowledge or approval of the IT or security department, creating unmanaged risk.

The monetary loss expected from a single occurrence of a risk, calculated as asset value multiplied by the exposure factor.

An authentication mechanism that lets a user log in once and gain access to multiple connected applications without re-entering credentials for each.

Phishing carried out through SMS text messages that lure victims into clicking malicious links or disclosing personal or financial information.

A point-in-time copy of a system or virtual machine's state that can be used to quickly restore it to that exact configuration.

Manipulating people into divulging confidential information or performing actions that compromise security, exploiting human trust rather than technical flaws.

A networking architecture that decouples the control plane from the data plane, allowing the network to be managed centrally and programmatically through software. This enables flexible, automated, and centrally enforced network policies.

A highly targeted phishing attack customized for a specific individual or organization using personal details to appear credible. When aimed at high-value executives it is known as whaling.

Malware that covertly gathers information about a user's activity, such as browsing habits or credentials, and transmits it to a third party. Adware and tracking software are common forms.

An attack that inserts malicious SQL statements into an application's input fields to read, modify, or delete data in the backend database.

A document that details the specific deliverables, tasks, timelines, and scope for a particular project, typically under a master service agreement.

The practice of concealing data inside another file, image, audio, or video so that the existence of the hidden message itself is not apparent.

An attack that compromises an organization indirectly by targeting a trusted third party such as a vendor, software provider, or hardware supplier. Inserting malicious code into a legitimate software update is a common method.

An encryption method that uses the same secret key to both encrypt and decrypt data, offering speed but requiring secure key exchange. AES is a common example.

A discussion-based, scenario-driven session in which stakeholders walk through their response to a hypothetical incident to validate plans and roles without affecting live systems. It is a low-cost way to test incident response and business continuity readiness.

A control category implemented through technology, such as encryption, firewalls, antivirus, and authentication systems. Also called a logical control.

An individual or group that carries out or intends to carry out malicious activity, categorized by attributes such as motivation, resources, and internal or external origin.

The proactive search through networks and systems to detect threats that have evaded existing security controls, rather than waiting for alerts.

A one-time password algorithm that generates a short-lived code derived from a shared secret and the current time, commonly refreshing every 30 seconds. It is widely used as a multifactor authentication factor in authenticator apps.

Replacing sensitive data with a non-sensitive substitute value (a token) that has no exploitable meaning, with the mapping stored securely in a separate vault.

A cryptographic protocol that provides confidentiality and integrity for data in transit, securing web, email, and other application traffic. It is the successor to SSL.

Malware disguised as legitimate or desirable software that, once executed, performs hidden malicious actions such as opening a backdoor.

A dedicated cryptographic chip built into a device's motherboard that securely stores keys, supports full-disk encryption, and enables platform integrity checks.

An attack in which adversaries register domain names that are common misspellings of legitimate sites, such as goggle.com, to capture traffic from users who mistype a URL. The lookalike sites are used to deliver malware or harvest credentials.

An all-in-one security appliance that combines multiple functions such as firewall, antivirus, intrusion prevention, and content filtering in a single platform.

Analytics that establish a baseline of normal behavior for users and devices and flag anomalous activity that may indicate a threat or compromise.

A technology that creates an encrypted tunnel over an untrusted network, allowing remote users or sites to communicate securely as if on a private network.

Voice phishing conducted over phone calls or voicemail, where an attacker impersonates a trusted party to extract sensitive information from the victim.

An automated assessment that probes systems, networks, or applications to identify known weaknesses, misconfigurations, and missing patches. A credentialed scan logs in with valid accounts to provide deeper, more accurate results than an unauthenticated scan.

A partially configured alternate facility with hardware and connectivity in place but requiring data restoration and setup before it can resume operations.

A targeted attack that compromises a website known to be frequented by the intended victims, infecting them when they visit the trusted site.

A firewall that inspects and filters HTTP/HTTPS traffic to and from a web application to block attacks such as SQL injection and cross-site scripting.

A digital certificate that secures a primary domain and all of its first-level subdomains using a single certificate with an asterisk in the name field, such as *.example.com. It simplifies certificate management across many subdomains.

Self-replicating malware that spreads automatically across networks without requiring user interaction or a host file. Its rapid propagation can consume bandwidth and resources in addition to delivering a payload.

A security model that assumes no implicit trust for any user or device, requiring continuous verification of every request regardless of its origin inside or outside the network.

A vulnerability that is unknown to the vendor or has no available patch, leaving systems exposed until a fix is developed and deployed.