Cybersecurity Glossary

The bedrock model of information security: Confidentiality (preventing unauthorized access), Integrity (ensuring data is unaltered and authentic), and Availability (guaranteeing authorized access upon request).

Common Vulnerabilities and Exposures: A standardized dictionary of publicly disclosed cybersecurity vulnerabilities (e.g. CVE-2021-44228 Log4j) maintained by MITRE to ensure consistent cross-industry tracking.

Common Vulnerability Scoring System: An open framework (v3.1 / v4.0) scoring security flaws from 0.0 to 10.0 based on Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and Confidentiality/Integrity/Availability impact.

Common Weakness Enumeration: A formal community-developed categorization system for software weaknesses, architectural design flaws, and code vulnerabilities (e.g. CWE-79 for XSS, CWE-89 for SQL Injection).

A security philosophy centered on "Never trust, always verify." Eliminates implicit trust based on network perimeter location, requiring strict identity verification and least privilege for every access request.

(PoLP) The foundational rule that any user, program, or system process should be granted only the bare minimum permissions necessary to complete its authorized job functions and nothing more.

Cross-Site Scripting: Occurs when an application reflects or stores untrusted user input without context-aware sanitization, allowing an attacker to execute arbitrary JavaScript in victim browsers to steal session cookies.

SQL Injection: A critical server-side flaw where unsanitized user inputs manipulate backend database queries, enabling attackers to bypass authentication, extract sensitive tables, or write web shells via INTO OUTFILE.

Cross-Site Request Forgery: An attack that tricks an authenticated victim's browser into transmitting unwanted state-changing HTTP requests (e.g. changing an email or password) using ambient session credentials without an anti-CSRF token.

Server-Side Request Forgery: Occurs when a web application accepts a remote URL from a user and fetches it without validation, enabling an attacker to coerce the server into port-scanning internal subnets or querying cloud metadata (169.254.169.254).

Insecure Direct Object Reference: A broken access control flaw where an endpoint accesses database records based on user-supplied identifiers (e.g. /api/invoice?id=1025) without verifying if the requesting user owns that object.

Remote Code Execution: The most severe vulnerability class, allowing an attacker to execute arbitrary OS system commands or machine code on a remote server across the network without physical access.

Local / Remote File Inclusion: Flaws in dynamic file loading functions (such as PHP include($_GET['page'])) that permit reading local system files (/etc/passwd) or executing remote scripts.

Content Security Policy: An HTTP response header allowing site administrators to declare an allowlist of approved sources for executable scripts, stylesheets, and images, drastically limiting Cross-Site Scripting impact.

Set Owner User ID: A special Linux permission bit (octal 4000) that causes an executable file to run with the privileges of the file owner (typically root) rather than the executing user. A primary vector for privilege escalation.

A network connection initiated by a compromised target machine outbound back to the attacker's listening listener (e.g. via Netcat). Used to bypass incoming stateful firewall rules that drop unsolicited inbound packets.

A security vulnerability in software or hardware that is unknown to the vendor and has zero official patches or security fixes available, leaving defenders vulnerable to immediate exploitation.

JSON Web Token: An open, compact URL-safe standard (RFC 7519) for transmitting claims securely between two parties. Composed of Header, Payload, and Cryptographic Signature separated by periods.

An industry-standard authorization framework enabling third-party applications to obtain limited access to an HTTP service on behalf of a resource owner without sharing the user's master password credentials.

Transport Layer Security: The cryptographic protocol securing communication over computer networks (HTTPS on TCP 443). Uses asymmetric cryptography for key exchange and symmetric ciphers (AES-GCM/ChaCha20) for session data encryption.

A Salt is a unique random string appended to a plaintext password before hashing to defeat precomputed Rainbow Tables. A Pepper is an application-level secret stored separately in an HSM or KMS to defeat stolen hash dumps.

Classless Inter-Domain Routing: A method for allocating IP addresses and IP routing (e.g. 192.168.1.0/24) replacing legacy Class A/B/C networks, specifying prefix bit lengths for subnet masks.

Network Address Translation: A networking technique that remaps private IP address spaces (RFC 1918) into a single or pool of public IP addresses by modifying network address headers in transit across a traffic routing device.

Domain Name System: The hierarchical naming system operating on UDP/TCP port 53 translating human-readable hostnames into binary IP addresses. Crucial in reconnaissance for discovering subdomains and mail infrastructure.

Security Information and Event Management: Software platforms (Splunk, Elastic, Microsoft Sentinel) that aggregate, correlate, and analyze log telemetry from servers, firewalls, and applications in real-time to alert on active intrusions.

Intrusion Detection / Prevention Systems: Network appliances or host agents (Snort, Suricata, Zeek). An IDS passively monitors traffic for signature/heuristic matches; an IPS sits in-line to actively drop malicious packet flows.

Endpoint / Extended Detection and Response: Advanced security software installed directly on endpoints (CrowdStrike, SentinelOne) monitoring system calls, process trees, and memory injections to isolate compromised hosts automatically.

Adversarial Tactics, Techniques, and Common Knowledge: A globally accessible knowledge base of adversary behaviors based on real-world cyber threat observations, organized into 14 tactics from Initial Access to Impact.