Study Guide
Glossary
Reviewed definitions of the terminology used throughout the Study Guide, linked to the lessons that teach them.
381 terms
No terms match your search. Try another term or clear the filters.
- AAA (Authentication, Authorisation and Accounting)
The three core access-control functions: authentication proves a claimed identity, authorisation decides what it may do and accounting records what it did.
Identification comes first but is not one of the three As.
Lessons: Identity and Access Management: Identification and AAA
See also: Identification, Authentication, Authorisation, Accounting, IAM
Source: Covered in Session 7; definition expanded for the Study Guide
- Access port
A switch port for an ordinary device such as a computer or printer. It belongs to one VLAN, and the frames on it carry no VLAN tag.
Lessons: Switch Ports, VLANs and 802.1Q Trunks
Source: Supplementary explanation
- Accessibility
Designing systems so that people with different needs, devices and assistive technologies can use them. It is part of usable security, not a reason to remove required protection.
Lessons: Security, Usability & Functionality
Source: Classroom session
- Accounting
Recording what an identity did on a system, such as signing in, opening files, making changes and being refused.
It is the last step of the access-control flow and the third A of AAA. The same idea is often called auditing or logging, and it has nothing to do with money.
Lessons: Identity and Access Management: Identification and AAA
See also: AAA, Audit log, Non-repudiation
Source: Covered in Session 7; definition expanded for the Study Guide
- Administrative control
A control based primarily on policies, procedures, governance, organisational rules, and people and processes, as opposed to technology or physical barriers.
In a three-category model of administrative, technical and physical controls, it covers most of what the four-category model splits between managerial and operational. The terms are not defined identically in every framework.
Lessons: Security Controls: Categories and Functions
See also: Managerial control, Operational control, Policy, Procedure
Source: Supplementary explanation
- AES (Advanced Encryption Standard)
The standard symmetric block cipher, with 128-, 192- or 256-bit keys.
Its design is public and it is fast enough to encrypt whole disks and network connections.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Data States and Encryption at Rest
See also: Symmetric encryption, Cipher
Source: Covered in Session 9; definition expanded for the Study Guide
- Agent-based scanning
Vulnerability scanning in which a small software component, an agent, is installed on each device and reports what it finds.
It gives deeper local visibility and covers devices that are only sometimes connected, but the agents must be deployed and maintained. Some syllabus wording calls this client-based.
Lessons: Attack Surfaces and Attack Vectors
See also: Agentless scanning, Vulnerability
Source: Covered in Session 8; definition expanded for the Study Guide
- Agentless scanning
Vulnerability scanning that installs no dedicated agent on the target and instead examines it remotely, using existing mechanisms such as SSH, WMI or an API.
It is easier to deploy centrally, but what it can see depends on network reachability and on the credentials it is given.
Lessons: Attack Surfaces and Attack Vectors
See also: Agent-based scanning, Vulnerability
Source: Covered in Session 8; definition expanded for the Study Guide
- ALE (Annualised Loss Expectancy)
The expected yearly loss from a risk, calculated as ALE = SLE × ARO.
Fictional example: SLE £20,000 × ARO 0.25 = ALE £5,000 per year. This is an expected value, not a guaranteed annual payment.
Lessons: Quantifying Impact: ALE and Business Impact Analysis, Assessing Risk
See also: SLE, ARO, Exposure factor, Quantitative risk assessment
Source: Classroom session
- Algorithm
A fixed, step-by-step method for carrying out a task. In cryptography, the published method that a cipher or a hash function follows.
By Kerckhoffs’s principle the algorithm can be public; the key is what must stay secret.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Cipher, Kerckhoffs’s principle, Hash function
Source: Supplementary explanation
- Alteration
An unauthorised or improper change to information or systems. Alteration threatens integrity.
Lessons: DAD Triad
See also: Integrity, DAD triad
Source: Classroom session
- Angler phishing
Phishing on social media in which the attacker poses as a company’s customer-support account and approaches people who are asking that company for help.
Lessons: Social Engineering and Phishing
See also: Phishing, Impersonation
Source: Covered in Session 8; definition expanded for the Study Guide
- Annex A
The list of reference security controls at the back of ISO/IEC 27001. An organisation compares the controls it has chosen against the list and records, for each one, whether it applies and why.
Annex A is a checklist to compare against, not a set of controls that every organisation must implement. The record of the comparison is the Statement of Applicability.
Lessons: Security Frameworks and Standards, Security Documentation
See also: ISO/IEC 27001, ISMS, Statement of Applicability
Source: Supplementary explanation
- Anonymisation
Processing data so that individuals can no longer be identified by any means reasonably likely to be used.
Genuinely anonymous data is no longer personal data. It is a high bar that has to be assessed, not assumed.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: De-identification, Pseudonymisation, Personal data
Source: Covered in Session 9; definition expanded for the Study Guide
- Anycast
Delivery to the nearest, or best-placed, of several devices that share the same address, as decided by routing.
Used, for example, by some DNS services so that a query reaches a nearby server.
Lessons: Unicast, Multicast, Broadcast and Anycast
See also: Unicast, Multicast, Broadcast
Source: Supplementary explanation
- APT (Advanced Persistent Threat)
A highly capable, well-resourced threat that targets a chosen victim, gains access in stages and stays hidden for a long time.
APT describes the style of a threat or campaign: patient, targeted, persistent and stealthy. Many APTs are linked to states, but the two terms are not synonyms.
Lessons: Nation-State Actors, APTs and MITRE ATT&CK
See also: Nation-state actor, Living off the land
Source: Covered in Session 8; definition expanded for the Study Guide
- ARO (Annualised Rate of Occurrence)
The expected number of times an incident occurs per year. Once every four years is 0.25; twice a year is 2.
ARO is not automatically the probability of at least one incident, and it can exceed one.
Lessons: Quantifying Impact: ALE and Business Impact Analysis
Source: Classroom session
- ARP (Address Resolution Protocol)
A protocol that finds the MAC address for an IPv4 address on the local network, using a broadcast request and a normally unicast reply.
Ordinary ARP messages are not authenticated. For a remote destination, a host resolves the MAC address of its next-hop router.
Lessons: DHCP and ARP
See also: MAC address, Default gateway, ARP cache, Neighbour Discovery
Source: Classroom session
- ARP cache
A device’s store of recently learned IPv4-to-MAC address mappings, so it does not have to send an ARP request for every packet.
Lessons: DHCP and ARP
See also: ARP, MAC address
Source: Classroom session
- Asset
Something an organisation values, such as information, a service, equipment or a business capability.
Lessons: Risk
See also: Threat, Vulnerability, Risk
Source: Classroom session
- Assurance
Evidence that gives confidence that security requirements are met or controls are working, within a defined scope and time.
Self-assessments, independent verification, audits, penetration tests and monitoring each give assurance about a narrower question than they may seem to.
Lessons: Assurance and the Limits of Penetration Testing
See also: Compliance, Penetration test, Cyber Essentials
Source: Supplementary explanation
- Asymmetric encryption
Cryptography that uses a mathematically related pair of keys: a public key that can be shared and a private key that is kept secret.
Data encrypted with a recipient’s public key can be decrypted only with the matching private key. It solves key distribution and is much slower than symmetric encryption.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Digital Signatures
See also: Symmetric encryption, Key pair, RSA, ECC
Source: Covered in Session 9; definition expanded for the Study Guide
- Attack chain
An illustrative sequence of connected attacker actions, used to find where controls could interrupt an attack. Session 1 used phishing, credential theft, remote access, internal reconnaissance, privilege escalation and data exfiltration.
It is not a fixed order that every attack follows; outcomes such as exfiltration and ransomware are possibilities, not compulsory stages.
Lessons: Attack Chain
See also: Phishing, Privilege escalation, Data exfiltration
Source: Classroom session
- Attack surface
Every point where an attacker could interact with, or try to get into, an organisation, system or application.
It is relative to what is being assessed: an organisation, one system and one application each have their own. The surface is where an attack could happen; the vector is the route actually used.
Lessons: Attack Surfaces and Attack Vectors, Threat Actor Types, Attributes and Motivations
See also: Attack vector, Exposure
Source: Covered in Session 8; definition expanded for the Study Guide
- Attack vector
The route or method an attacker uses to reach a target, such as a phishing email, stolen remote-access credentials or an infected removable drive.
A vector is a route. A weakness is what makes the route exploitable.
Lessons: Attack Surfaces and Attack Vectors, Threat Actor Types, Attributes and Motivations
See also: Attack surface, Phishing
Source: Covered in Session 8; definition expanded for the Study Guide
- Audit log
A record of which account did what and when on a system, such as sign-ins, changes and approvals.
A log supports accountability only when accounts are individual and the people it records cannot alter it.
Lessons: Non-Repudiation
See also: Non-repudiation, Accounting
Source: Supplementary explanation
- Authentication
Establishing or verifying a claimed identity, for example when a user signs in.
A successful sign-in does not by itself grant permission to every resource; that is authorisation.
Lessons: Least Privilege, CIA Triad, Identity and Access Management: Identification and AAA
See also: Authorisation, Multi-factor authentication, Identification, Authentication factor, AAA
Source: Supplementary explanation
- Authentication factor
A kind of evidence used to prove an identity: something you know, something you have or something you are.
Multi-factor authentication needs two or more different kinds. Two things you know, such as a password and a PIN, are one factor used twice.
Lessons: Identity and Access Management: Identification and AAA
See also: Authentication, Multi-factor authentication
Source: Supplementary explanation
- Authorisation
Deciding which resources and actions an identity is permitted to use.
It is decided after authentication has established who the user or process is, and should follow least privilege. Permission to carry out security testing is a separate idea; see Security-testing authorisation.
Lessons: Least Privilege, Ethics, Authorisation and Responsible Disclosure, Identity and Access Management: Identification and AAA
See also: Authentication, Least privilege, Security-testing authorisation, AAA
Source: Supplementary explanation
- Availability
The security objective of keeping systems, services and information accessible to authorised users when required.
Lessons: CIA Triad
Source: Classroom session
- BEC (Business Email Compromise)
A targeted fraud that impersonates or compromises a trusted business identity or email account in order to make a convincing request, typically for a payment or for sensitive data.
Fictional example: A finance officer receives a message, apparently from a known supplier in an existing email thread, asking for future invoices to be paid into a new bank account.
Lessons: Social Engineering and Phishing
See also: Impersonation, Spear phishing, Email spoofing
Source: Covered in Session 8; definition expanded for the Study Guide
- BIA (Business Impact Analysis)
An analysis of important activities, their dependencies and the consequences of disruption over time, used to set impact and recovery priorities.
Lessons: Quantifying Impact: ALE and Business Impact Analysis
See also: Risk
Source: Classroom session
- Binary
A base-2 number system that uses only the digits 0 and 1. Each position is worth twice the position to its right: 1, 2, 4, 8 and so on.
Lessons: Binary, Decimal and Hexadecimal
See also: Octet, Hexadecimal
Source: Study Buddy session
- Birthday bound
The limit on collision resistance: a collision in an n-bit hash can be found in about 2 to the power n/2 attempts, far fewer than the 2 to the power n needed to match one chosen digest.
It is named after the puzzle in which 23 people are enough for two of them probably to share a birthday. It is why a 256-bit digest gives about 128 bits of protection against collisions.
Lessons: Hashing and Integrity Checking
See also: Hash collision, Collision resistance, Preimage resistance
Source: Covered in Session 9; definition expanded for the Study Guide
- BitLocker
The Windows feature that encrypts whole volumes, normally using the computer’s TPM to release the key at start-up.
Lessons: Data States and Encryption at Rest, Key Management, Cryptographic Hardware and Escrow
See also: EFS, Full-disk encryption, TPM
Source: Covered in Session 9; definition expanded for the Study Guide
- Block cipher
A cipher that encrypts data in blocks of a fixed size. AES is a block cipher that works on 128-bit blocks.
Lessons: Symmetric, Asymmetric and Hybrid Encryption
See also: AES, Cipher, Symmetric encryption
Source: Supplementary explanation
- Blockchain
A ledger made of blocks of records in which each block includes the hash of the block before it.
Changing an earlier block breaks every later link. Many independently held copies, kept in agreement by consensus, are what make rewriting impractical. A blockchain is not necessarily public.
Lessons: Blockchain and Hash-Linked Records
See also: Hash function, Open public ledger
Source: Covered in Session 9; definition expanded for the Study Guide
- Botnet
A group of compromised devices that an attacker can control remotely, for example to send attack traffic together.
Botnets are one source of DDoS traffic, but not every contributing system has to be a compromised computer.
Lessons: Distributed Denial of Service (DDoS)
Source: Supplementary explanation
- Broadcast
Communication sent to every device in the relevant broadcast domain. Routers do not normally forward ordinary local broadcasts.
Lessons: Unicast, Multicast, Broadcast and Anycast, DHCP and ARP
See also: Unicast, Multicast, Broadcast domain, Broadcast address
Source: Classroom session
- Broadcast address
The last address of an IPv4 subnet, with all host bits set to 1. Traffic sent to it reaches every device in that subnet.
/31 point-to-point links and /32 single-host routes do not reserve a broadcast address.
Lessons: Subnetting: Network, Broadcast and Usable Addresses
See also: Network address, Broadcast
Source: Supplementary explanation
- Broadcast domain
The set of devices that receive one another’s local broadcasts. It is often bounded by a VLAN, and routers do not normally forward ordinary broadcasts between domains.
Lessons: Unicast, Multicast, Broadcast and Anycast, Switch Ports, VLANs and 802.1Q Trunks
Source: Classroom session
- Brute-force attack
An attack that tries every possible key, or every possible password, until one works.
A large enough keyspace makes it impractical, which is why key length and password length matter.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Password Storage: Salting, Stretching and Peppering
See also: Keyspace, Key length, Rainbow table
Source: Covered in Session 9; definition expanded for the Study Guide
- Caesar cipher
A classical cipher that replaces each letter with the letter a fixed number of places along the alphabet. The shift is the key.
With only 25 useful shifts, every key can be tried in moments.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Substitution cipher, Brute-force attack, Keyspace
Source: Covered in Session 9; definition expanded for the Study Guide
- CBDC (Central bank digital currency)
Digital money issued by a central bank: the electronic equivalent of banknotes.
It does not inherently require a blockchain. A central bank is a trusted central party and can keep its ledger in a conventional database.
Lessons: Blockchain and Hash-Linked Records
See also: Blockchain, Ledger
Source: Supplementary explanation
- Certificate authority (CA)
An organisation that issues digital certificates, signing each one to vouch that a public key belongs to the named subject.
A public CA is trusted by default in operating systems and browsers; a private CA is trusted only by devices configured to trust it. A CA does not certify that a website is safe.
Lessons: Public Key Infrastructure and Digital Certificates, Certificate Validity and Revocation: CRLs and OCSP
See also: Digital certificate, Root certificate, Intermediate CA
Source: Covered in Session 9; definition expanded for the Study Guide
- Certificate chain
The sequence of certificates from a leaf, through one or more intermediate CAs, to a root, each signed by the one above it.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Leaf certificate, Intermediate CA, Root certificate, Trust anchor
Source: Covered in Session 9; definition expanded for the Study Guide
- Certificate expiry
The planned end of a certificate’s life: the “not after” date written inside it. After that date, software will not accept the certificate.
It is checked from the certificate itself, with no network request, so it cannot be blocked. Revocation, by contrast, ends a certificate early and has to be looked up.
Lessons: Certificate Validity and Revocation: CRLs and OCSP, Public Key Infrastructure and Digital Certificates
See also: Certificate revocation, Digital certificate
Source: Covered in Session 9; definition expanded for the Study Guide
- Certificate revocation
A certificate authority withdrawing a certificate before its expiry date, for example because its private key was compromised.
Revocation works only if the software relying on the certificate finds out, and that checking has practical limits.
Lessons: Certificate Validity and Revocation: CRLs and OCSP, Public Key Infrastructure and Digital Certificates
See also: CRL, OCSP, Digital certificate
Source: Covered in Session 9; definition expanded for the Study Guide
- Checksum
A digest published or stored alongside data, so that a copy can be checked against it.
A matching checksum shows that a file matches the published value. It does not show who produced the file, and is only as trustworthy as its source.
Lessons: Hashing and Integrity Checking
See also: Message digest, Hash function, Integrity
Source: Covered in Session 9; definition expanded for the Study Guide
- CIA triad (CIA: Confidentiality, Integrity and Availability)
Three fundamental information security objectives: confidentiality, integrity and availability.
CIA describes outcomes to protect, not an attack sequence. An incident can affect one, two or all three objectives.
See also: Confidentiality, Integrity, Availability, DAD triad, Non-repudiation
Source: Classroom session
- CIDR (Classless Inter-Domain Routing)
Classless addressing that writes the number of network bits after a slash, such as 192.168.1.0/24, instead of relying on historical Class A, B and C categories.
Lessons: Classful Addressing, Subnet Masks and CIDR, Subnetting: Network, Broadcast and Usable Addresses
See also: IP address, Private IPv4 address, Prefix length, Subnet mask, Classful addressing
Source: Classroom session
- CIO (Chief Information Officer)
The senior executive who typically leads an organisation’s information-technology strategy and operations.
Responsibilities and reporting lines vary between organisations.
Lessons: Security Roles and Responsibilities
See also: CISO, CSO, ISSO, Governance
Source: Covered in Sessions 4 and 7; definition expanded for the Study Guide
- Cipher
An algorithm that turns plaintext into ciphertext, and back again, under the control of a key.
The cipher can be public. Its security should rest on the key.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Symmetric, Asymmetric and Hybrid Encryption
See also: Cryptographic key, Kerckhoffs’s principle, Encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- Cipher suite
A named set of algorithms that a TLS connection will use, covering key exchange, authentication, encryption and integrity.
The two sides agree one during the handshake. In TLS 1.2, only suites with ECDHE or DHE in the name give forward secrecy.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy
See also: TLS, Key exchange, Forward secrecy
Source: Supplementary explanation
- Ciphertext
Data after encryption: unreadable without the key that decrypts it.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Symmetric, Asymmetric and Hybrid Encryption
See also: Plaintext, Encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- CIRT (Computer Incident Response Team)
A team that responds to security incidents: investigating what happened, containing the incident and coordinating recovery.
Memory aid: the CIRT responds. CERT and CSIRT are other names for the same kind of team.
Lessons: Security Teams and Competencies
See also: SOC, DevSecOps, Security incident
Source: Covered in Session 7; definition expanded for the Study Guide
- CISO (Chief Information Security Officer)
The senior executive who typically leads information and cybersecurity strategy, governance, risk and protection.
Responsibilities and reporting lines vary between organisations, and some use the title CSO for the same job.
Lessons: Security Roles and Responsibilities
See also: CIO, CSO, ISSO, Governance
Source: Covered in Session 4; definition expanded for the Study Guide
- Classful addressing
The historical IPv4 scheme in which the first octet decided an address’s class (A, B or C) and so its default split between network and host.
It has been replaced by CIDR, where the prefix length is configured rather than implied by the class.
Lessons: Classful Addressing, Subnet Masks and CIDR
See also: CIDR, Subnet mask
Source: Study Buddy session
- Collision resistance
The property that it is infeasible to find two different inputs that produce the same digest.
Because of the birthday effect, an n-bit digest gives about n/2 bits of protection against collisions.
Lessons: Hashing and Integrity Checking
See also: Preimage resistance, Hash collision
Source: Covered in Session 9; definition expanded for the Study Guide
- Common Name (CN)
An older, single, free-text field in a certificate’s Subject that used to hold a website’s name.
Modern clients do not use it to match a website’s name; they check the Subject Alternative Name.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Subject Alternative Name, Digital certificate
Source: Covered in Session 9; definition expanded for the Study Guide
- Compensating control
An alternative safeguard used when the preferred control cannot be implemented, reaching a similar security objective another way.
It is not simply extra security: it stands in for a specific control that cannot be used.
Fictional example: A legacy system cannot support multi-factor authentication, so access to it is limited to a trusted network and a monitored jump host.
Lessons: Security Controls: Categories and Functions, Attack Surfaces and Attack Vectors
See also: Control, Multi-factor authentication
Source: Covered in Session 7; definition expanded for the Study Guide
- Compliance
Meeting applicable legal, contractual and internal requirements.
Assessment or certification provides assurance within a scope at a point in time; compliance is not the same as security.
Lessons: Governance, Risk and Compliance (GRC)
Source: Classroom session
- Computer Misuse Act 1990
The main UK law on computer crime. It makes unauthorised access to computer material, and related acts, criminal offences.
Permission from someone entitled to give it is what separates authorised security testing from an offence.
Lessons: Ethics, Authorisation and Responsible Disclosure
See also: Security-testing authorisation, Penetration test
Source: Supplementary explanation
- Confidentiality
The security objective of restricting information to authorised people, systems or processes.
Fictional example: A customer can view their own booking but not another customer’s.
Lessons: CIA Triad, Data States and Encryption at Rest
See also: CIA triad, Disclosure
Source: Classroom session
- Consensus
The agreed process by which the participants in a distributed ledger decide which new block is added, so that every honest copy stays the same.
It is what makes rewriting a blockchain impractical: a changed copy disagrees with everyone else’s and is rejected. Hash-linking alone only makes a change evident.
Lessons: Blockchain and Hash-Linked Records
See also: Blockchain, Ledger
Source: Supplementary explanation
- Content delivery network (CDN: Content Delivery Network)
A distributed set of servers that delivers suitable web content from locations close to users, reducing demand on the origin server.
It helps only for the services and content it covers; an origin that is reachable directly can still be attacked.
Lessons: Distributed Denial of Service (DDoS)
See also: DDoS
Source: Supplementary explanation
- Control
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A control normally reduces the likelihood of harm, its impact or both; it does not necessarily remove the threat or the vulnerability. Controls are described by category (how they are implemented) and by functional type (what they do).
Lessons: Risk, Defence in Depth, Treating Risk, Security Controls: Categories and Functions
See also: Risk, Defence in depth, Residual risk, Managerial control, Operational control, Technical control, Physical control, Compensating control
Source: Supplementary explanation
- Controller
The organisation that determines the purposes and means of processing personal data.
Actual activities decide who is controller or processor, not the label a contract uses.
Lessons: Data Protection: UK GDPR and the DPA 2018
See also: Processor
Source: Supplementary explanation
- Corrective control
A control that puts things right after an incident, such as restoring from backup, removing malware or reconfiguring a compromised system.
Defence in Depth separates this work into responsive and recovery controls.
Lessons: Security Controls: Categories and Functions
See also: Preventative control, Detective control, Responsive control, Recovery control
Source: Covered in Session 7; definition expanded for the Study Guide
- Credential theft
Obtaining someone’s sign-in details, such as a username and password, without authorisation.
A stolen password is not proof that an attacker signed in successfully; MFA and other checks may still block its use.
Lessons: Attack Chain
See also: Phishing, Authentication
Source: Classroom session
- CRL (Certificate revocation list)
A signed list, published periodically by a certificate authority, of the serial numbers of certificates it has revoked.
It is only as fresh as its last publication.
Lessons: Certificate Validity and Revocation: CRLs and OCSP
See also: OCSP, Certificate revocation
Source: Covered in Session 9; definition expanded for the Study Guide
- Cryptanalysis
The study of breaking cryptographic protection: recovering plaintext or a key without being given it.
A cipher is trusted only after skilled cryptanalysts have tried to break it and failed.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Cryptography, Brute-force attack
Source: Covered in Session 9; definition expanded for the Study Guide
- Cryptographic key
A secret value that controls what a cipher does. The same algorithm with a different key gives a different result.
A key should be generated from unpredictable random values and protected for its whole life.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Symmetric, Asymmetric and Hybrid Encryption, Key Management, Cryptographic Hardware and Escrow
See also: Key length, Keyspace, Entropy
Source: Supplementary explanation
- Cryptographic module
The hardware or software component that actually performs cryptography, such as an HSM or a software library. It is what a FIPS 140 validation applies to.
Lessons: Key Management, Cryptographic Hardware and Escrow
Source: Supplementary explanation
- Cryptography
The practice of protecting information by transforming it, so that only the intended parties can read it or trust it.
Cryptanalysis is the study of breaking that protection, and cryptology is the field that covers both.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Cryptanalysis, Cipher, Encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- Cryptology
The field that covers both cryptography, which protects information, and cryptanalysis, which studies how that protection is broken.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Cryptography, Cryptanalysis
Source: Covered in Session 9; definition expanded for the Study Guide
- CSO (Chief Security Officer)
A senior executive responsible for security across an organisation, whose remit may include physical and corporate security as well as information security.
Some organisations use the title interchangeably with CISO.
Lessons: Security Roles and Responsibilities
Source: Covered in Session 7; definition expanded for the Study Guide
- CSPRNG (Cryptographically secure random number generator)
A random number generator designed so that its output cannot be predicted, used to create keys, salts and other secret values.
The ordinary “random” function of a programming language is predictable and must not be used for keys.
Lessons: Key Management, Cryptographic Hardware and Escrow
See also: Entropy, Cryptographic key
Source: Supplementary explanation
- CSR (Certificate signing request)
A request sent to a certificate authority, containing the applicant’s public key and requested identity and signed with the applicant’s private key.
The private key itself never leaves the applicant.
Lessons: Public Key Infrastructure and Digital Certificates, Certificate Validity and Revocation: CRLs and OCSP
See also: Certificate authority, Digital certificate, Private key
Source: Covered in Session 9; definition expanded for the Study Guide
- CVE (Common Vulnerabilities and Exposures)
A system of unique identifiers for publicly disclosed vulnerabilities, written as CVE-year-number, so everyone can refer to the same flaw.
A CVE ID names a vulnerability; it does not rate its severity. Not every disclosed vulnerability receives one.
Lessons: Vulnerabilities and Exposure
See also: NVD, CVSS, Vulnerability
Source: Supplementary explanation
- CVSS (Common Vulnerability Scoring System)
A standard for rating the technical severity of vulnerabilities. The same base score can carry different business risk depending on context.
Lessons: Assessing Risk, Vulnerabilities and Exposure
See also: Vulnerability, Risk, NVD
Source: Classroom session
- Cyber Essentials
A UK certification scheme covering five technical control areas and based on verified self-assessment. Cyber Essentials Plus adds technical verification.
Lessons: Security Frameworks and Standards, Firewalls, Traffic Filtering and Segmentation
See also: NIST CSF
Source: Classroom session
- DAD triad (DAD: Disclosure, Alteration and Denial)
The classroom model of three adverse outcomes, disclosure, alteration and denial, which threaten confidentiality, integrity and availability respectively.
Some materials expand the final D as Destruction. Session 2 used Denial; the two terms are not identical.
Lessons: DAD Triad
See also: CIA triad, Disclosure, Alteration, Denial
Source: Classroom session
- Data at rest
Data that is stored, and not currently moving or being processed.
Protected by disk, file or database encryption.
Lessons: Data States and Encryption at Rest
See also: Data in transit, Data in use, Full-disk encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- Data classification
Labelling information by sensitivity so that access, storage, sharing, retention and disposal controls match it.
The course hierarchy Public, Internal, Confidential and Secret/Restricted is illustrative. A label alone enforces no control, and personal-data status is a separate legal question.
Lessons: Data Classification
See also: Personal data
Source: Classroom session
- Data exfiltration
The unauthorised transfer of information out of an environment.
Restoring systems afterwards does not undo the disclosure: copies already taken remain with the attacker.
Lessons: Attack Chain
See also: Disclosure, Ransomware
Source: Classroom session
- Data in transit
Data that is moving across a network.
Protected by transport encryption such as TLS.
Lessons: Data States and Encryption at Rest, Transport Encryption, Key Agreement and Forward Secrecy
See also: Data at rest, Data in use, TLS
Source: Covered in Session 9; definition expanded for the Study Guide
- Data in use
Data that is loaded in memory and being processed.
The hardest state to protect, because a processor ordinarily needs data in plain form to work on it.
Lessons: Data States and Encryption at Rest
See also: Data at rest, Data in transit, Secure enclave
Source: Covered in Session 9; definition expanded for the Study Guide
- Data masking
Replacing all or part of a value with substitute characters or realistic fictitious data, so that it can be displayed or used for testing without exposing the original.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: Tokenisation, De-identification
Source: Covered in Session 9; definition expanded for the Study Guide
- Data Protection Act 2018 (DPA 2018)
The UK Act of Parliament that sits beside the UK GDPR and fills in the UK-specific detail of data-protection law.
The two are read together: the UK GDPR sets out the general rules, and the Act adds conditions, exemptions and the separate rules for law-enforcement and intelligence-service use of personal data.
Lessons: Data Protection: UK GDPR and the DPA 2018
See also: UK GDPR, ICO, Personal data
Source: Supplementary explanation
- Data subject
The identified or identifiable living individual whom personal data is about.
The UK GDPR gives data subjects rights over their personal data, such as access, rectification and erasure, most of which have conditions.
Lessons: Data Protection: UK GDPR and the DPA 2018
See also: Personal data, Controller
Source: Supplementary explanation
- Database encryption
Encryption of a database’s stored files and backups by the database system, which decrypts automatically for every authorised connection.
It protects against theft of the files, disks or backups. It does not hide data from an account that is authorised to query the database.
Lessons: Data States and Encryption at Rest
See also: Record-level encryption, Data at rest
Source: Covered in Session 9; definition expanded for the Study Guide
- DDoS (Distributed Denial of Service)
An attack that uses traffic from many sources to exhaust a service’s bandwidth, connection handling or application resources, so legitimate users cannot use it.
Mitigation has to match the bottleneck: local filtering cannot help if the incoming link is already saturated.
Lessons: Distributed Denial of Service (DDoS), DAD Triad
See also: Denial, Availability, Denial of service, Botnet, Rate limiting
Source: Classroom session
- De-identification
Removing or altering the information that directly identifies individuals in a dataset.
It does not necessarily make the data anonymous: people may still be re-identifiable from what remains.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: Anonymisation, Pseudonymisation, Personal data
Source: Covered in Session 9; definition expanded for the Study Guide
- Decryption
Turning ciphertext back into plaintext, using the correct key.
It is the reverse of encryption. Without the key, decryption should not be feasible.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Symmetric, Asymmetric and Hybrid Encryption
See also: Encryption, Ciphertext, Plaintext, Cryptographic key
Source: Supplementary explanation
- Default deny
A policy under which any traffic not explicitly allowed by a rule is blocked.
Only traffic someone deliberately allowed can pass, so forgotten or unnecessary services are blocked without needing their own rule.
Lessons: Firewalls, Traffic Filtering and Segmentation
See also: Firewall rule, Least privilege
Source: Supplementary explanation
- Default gateway
The next-hop router a device uses when no more specific route to a destination exists.
Lessons: IP forwarding, default gateways and NAT/PAT, DHCP and ARP, Inspecting Network Configuration: Windows, Linux and VyOS
See also: Router, ARP, Default route, Routing table
Source: Classroom session
- Default route
The route 0.0.0.0/0, which matches any IPv4 destination that has no more specific route. It points to the default gateway.
Lessons: IP forwarding, default gateways and NAT/PAT, Inspecting Network Configuration: Windows, Linux and VyOS
See also: Routing table, Default gateway
Source: Study Buddy session
- Defence in depth
Using several complementary layers of preventative, detective, responsive and recovery controls, so that one failure does not leave assets unprotected.
Independence matters more than product count: one unrestricted account able to disable several layers undermines them all.
Lessons: Defence in Depth
See also: Control, Preventative control, Detective control, Responsive control, Recovery control, Segmentation
Source: Supplementary explanation
- Denial
Preventing authorised users from accessing information or services when required. Denial threatens availability.
Denial differs from destruction: an overloaded service can be unreachable while its data remains intact.
Lessons: DAD Triad
See also: Availability, DAD triad, DDoS
Source: Classroom session
- Denial of service (DoS: Denial of Service)
An attack that attempts to stop legitimate users from accessing a service, for example by exhausting the resources it depends on.
A distributed denial-of-service (DDoS) attack does the same using traffic from many sources.
Lessons: Distributed Denial of Service (DDoS)
See also: DDoS, Denial, Availability
Source: Supplementary explanation
- Detective control
A control that makes suspicious or unwanted activity visible, such as monitoring unusual sign-ins.
Detection only helps if someone is responsible for acting on what it finds.
Lessons: Defence in Depth, Security Controls: Categories and Functions
See also: Preventative control, Responsive control, Recovery control, Corrective control, Deterrent control
Source: Supplementary explanation
- Deterrent control
A control that discourages unwanted behaviour, such as visible CCTV (closed-circuit television), a warning sign or a banner stating that a system is monitored.
Lessons: Security Controls: Categories and Functions
See also: Directive control, Detective control
Source: Covered in Session 7; definition expanded for the Study Guide
- DevSecOps (Development, Security and Operations)
A way of working that builds security into software and system development and operations from the beginning, instead of adding it at the end.
Memory aid: DevSecOps builds securely.
Lessons: Security Teams and Competencies
Source: Covered in Session 7; definition expanded for the Study Guide
- DHCP (Dynamic Host Configuration Protocol)
An application-layer protocol that automatically provides IP configuration, such as an address, subnet mask, default gateway and DNS server information.
IPv4 DHCP uses Discover, Offer, Request and Acknowledge (DORA) over UDP, with server port 67 and client port 68.
Lessons: DHCP and ARP
See also: Default gateway, DNS
Source: Classroom session
- Dictionary attack
Guessing passwords from a list of likely ones, such as leaked passwords, dictionary words and common variations, instead of trying every combination.
Lessons: Password Storage: Salting, Stretching and Peppering
See also: Brute-force attack, Rainbow table, Offline attack
Source: Supplementary explanation
- Diffie-Hellman
A method by which two parties each contribute a value and both compute the same shared secret, without the secret itself being sent.
ECDH is the elliptic-curve version. It needs authentication alongside it: otherwise an attacker in the middle can run a separate exchange with each side.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy, Symmetric, Asymmetric and Hybrid Encryption
See also: ECDHE, Key exchange, Ephemeral key
Source: Supplementary explanation
- Digital certificate
A document, signed by a certificate authority, that binds a public key to the identity of its subject. The standard format is X.509.
A certificate is public. It shows control of a name and a key, not that its holder is trustworthy.
Lessons: Public Key Infrastructure and Digital Certificates, Certificate Validity and Revocation: CRLs and OCSP, Transport Encryption, Key Agreement and Forward Secrecy, Digital Signatures
See also: Certificate authority, Public key, Subject Alternative Name, Certificate chain
Source: Covered in Session 9; definition expanded for the Study Guide
- Digital signature
A value produced with a private key that only the signer should hold, which anyone can check with the matching public key to confirm who signed some content and that it has not changed since.
One mechanism supports two properties: a failed check reveals that the content changed (integrity), and a valid check is evidence of who signed (non-repudiation). It does not keep the content secret.
Lessons: Non-Repudiation, Digital Signatures, Public Key Infrastructure and Digital Certificates, Hashing and Integrity Checking
See also: Non-repudiation, Integrity, Private key, Public key, Hash function
Source: Supplementary explanation
- Direct identifier
A piece of information that identifies a person by itself, such as a name, an email address or a pupil number.
Removing direct identifiers is de-identification. People may still be identified indirectly, by a combination of other details.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: De-identification, Re-identification, Personal data
Source: Supplementary explanation
- Directive control
A control that tells people what they are expected to do, such as a policy, a procedure or a mandatory instruction.
It addresses people who intend to follow the rules; a deterrent addresses someone thinking of breaking them.
Lessons: Security Controls: Categories and Functions
See also: Deterrent control, Policy, Procedure
Source: Covered in Session 7; definition expanded for the Study Guide
- Disclosure
Information becoming accessible to an unauthorised party. Disclosure threatens confidentiality, even if the original information is unchanged.
Lessons: DAD Triad
See also: Confidentiality, DAD triad
Source: Classroom session
- DKIM (DomainKeys Identified Mail)
An email-authentication control that adds a cryptographic signature to a message, so the receiver can verify that the signing domain sent it and that the signed content has not been altered.
The public key used to check the signature is published in the signing domain’s DNS records.
Lessons: Social Engineering and Phishing
See also: SPF, DMARC, Digital signature
Source: Supplementary explanation
- DMARC (Domain-based Message Authentication, Reporting and Conformance)
A policy, published in DNS, that builds on SPF and DKIM: it requires one of them to pass in alignment with the visible From domain, tells receivers how to handle messages that fail, and provides reporting.
DMARC does not stop mail sent from a genuinely compromised account or from a lookalike domain that the attacker controls.
Lessons: Social Engineering and Phishing
See also: SPF, DKIM, Email spoofing
Source: Supplementary explanation
- DNS (Domain Name System)
The system that translates domain names into IP addresses. It commonly uses port 53 over UDP and TCP.
Lessons: HTTPS: TCP, TLS and web communication, Inspecting Network Configuration: Windows, Linux and VyOS
See also: IP address
Source: Classroom session
- Due care
Taking reasonable action to address the risks that have been identified.
Memory aid: do something sensible about it. Reasonable action does not mean removing every risk.
Fictional example: Having found that its backups are untested, an organisation tests them and fixes what fails.
Lessons: Security Roles and Responsibilities
See also: Due diligence, Risk, Control
Source: Covered in Session 7; definition expanded for the Study Guide
- Due diligence
Investigating, assessing and understanding the risks.
Memory aid: find out what could go wrong. It comes before due care, which acts on what it finds.
Fictional example: Before relying on its backups, an organisation checks whether they have ever been tested.
Lessons: Security Roles and Responsibilities
See also: Due care, Risk, Gap analysis
Source: Covered in Session 7; definition expanded for the Study Guide
- ECC (Elliptic curve cryptography)
A family of asymmetric algorithms based on the mathematics of elliptic curves, used for key agreement and digital signatures.
It is a family, not one algorithm, and gives strength comparable to RSA with much shorter keys.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Transport Encryption, Key Agreement and Forward Secrecy
See also: Asymmetric encryption, RSA, ECDHE
Source: Covered in Session 9; definition expanded for the Study Guide
- ECDHE (Elliptic Curve Diffie-Hellman Ephemeral)
A key agreement in which each side generates a temporary elliptic-curve key pair, exchanges the public halves and derives the same shared secret.
The secret itself is never transmitted. The final E, ephemeral, is what gives forward secrecy.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy
See also: Key exchange, Ephemeral key, Forward secrecy, ECC
Source: Covered in Session 9; definition expanded for the Study Guide
- ECDSA (Elliptic Curve Digital Signature Algorithm)
A digital signature algorithm from the elliptic-curve family. It signs and verifies; it does not encrypt.
Lessons: Symmetric, Asymmetric and Hybrid Encryption
See also: ECC, Digital signature
Source: Supplementary explanation
- EFS (Encrypting File System)
The Windows feature that encrypts individual files and folders on behalf of a user account.
Each file has its own symmetric key, which is protected with the user’s public key.
Lessons: Data States and Encryption at Rest
See also: BitLocker, Hybrid encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- Email spoofing
Forging part of an email, such as the display name or the sender’s address, so that the message appears to come from someone else.
Lessons: Social Engineering and Phishing
See also: SPF, DKIM, DMARC, BEC
Source: Covered in Session 8; definition expanded for the Study Guide
- Encapsulation
Adding control information at the applicable layers as data moves down the stack for transmission. The receiver processes that information in reverse, which is called decapsulation.
Lessons: OSI and TCP/IP Models
See also: OSI model, MTU, Frame, Packet, Segment
Source: Classroom session
- Encoding
Changing how data is represented, using a public scheme and no key, so that anyone can reverse it. Base64 is an example.
Encoding is for compatibility, not secrecy: it gives no confidentiality.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Hashing and Integrity Checking
See also: Encryption, Hash function
Source: Covered in Session 9; definition expanded for the Study Guide
- Encryption
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
Encryption is reversible by a key holder, which distinguishes it from encoding (reversible by anyone) and hashing (reversible by nobody).
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Symmetric, Asymmetric and Hybrid Encryption, Data States and Encryption at Rest
See also: Encoding, Hash function, Cipher, Confidentiality
Source: Covered in Session 9; definition expanded for the Study Guide
- Endpoint
A device at the end of a network connection that people or programs actually use: a laptop, desktop computer, phone, tablet or server.
Endpoints are where people read email and open files, so they are where much malicious software first runs.
Lessons: Defence in Depth, Attack Surfaces and Attack Vectors
See also: Endpoint protection, Host, Malware
Source: Supplementary explanation
- Endpoint protection
Security software installed on each computer or phone to block malicious programs, raise an alert about suspicious activity and help to isolate an affected device. Antivirus is the best-known kind.
It protects the device it runs on. It does not replace updates, access restrictions or someone acting on its alerts.
Lessons: Defence in Depth, Attack Chain
See also: Endpoint, Malware, Defence in depth
Source: Supplementary explanation
- Entropy
The measure of unpredictability in the random values used to generate keys.
A key generated from too little entropy can be guessed however long it is.
Lessons: Key Management, Cryptographic Hardware and Escrow
See also: Cryptographic key, Key length
Source: Covered in Session 9; definition expanded for the Study Guide
- Ephemeral key
A temporary key generated for one connection and discarded when it ends.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy
See also: ECDHE, Forward secrecy, Session key
Source: Covered in Session 9; definition expanded for the Study Guide
- Ethernet
The standard way devices on a wired local network send data to each other, in units called frames that carry the MAC address of the sender and of the intended receiver.
Ethernet works within one local network. Reaching a device on another network needs IP addresses and a router as well.
Lessons: What Is a Network?, Ethernet Switching and MAC Addresses
See also: Frame, MAC address, Switch, LAN
Source: Supplementary explanation
- Exposure
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
A weakness in a service that nobody else can reach is harder to exploit than the same weakness in an internet-facing service, so reducing unnecessary exposure is a core defensive step.
Lessons: Vulnerabilities and Exposure
See also: Vulnerability, Shodan
Source: Classroom session
- Exposure factor (EF)
The fraction of an asset’s value that one incident would be expected to destroy, used to estimate SLE as asset value × exposure factor.
This breakdown was not taught in class; it is one way an organisation might arrive at a single loss estimate.
Lessons: Quantifying Impact: ALE and Business Impact Analysis
Source: Supplementary explanation
- File-level encryption
Encryption of chosen files or folders, often with a key tied to one user, so that other users of the same computer cannot read them.
It protects only what was chosen for encryption. It is often used together with full-disk encryption, which defends against a different threat.
Lessons: Data States and Encryption at Rest
See also: EFS, Full-disk encryption, Data at rest
Source: Supplementary explanation
- FIPS 140
The United States government standard against which cryptographic modules are tested and validated.
FIPS 140-3 supersedes FIPS 140-2. A validation applies to a specific module, not to a whole product or organisation.
Lessons: Key Management, Cryptographic Hardware and Escrow
Source: Covered in Session 9; definition expanded for the Study Guide
- Firewall
A control that allows or blocks network traffic according to configured rules.
Traffic that a firewall permits can still be malicious, and a firewall is only as effective as its configuration.
Lessons: Defence in Depth, Firewalls, Traffic Filtering and Segmentation
See also: Segmentation, NAT, Firewall rule, Default deny, Stateful firewall, Web application firewall
Source: Classroom session
- Firewall rule
An entry in a firewall policy that combines conditions, such as source, destination, protocol and port, with an action: allow or deny.
Rules are usually checked from the top, and the first rule that matches decides what happens, so their order matters.
Fictional example: Allow staff devices to reach the records server on TCP 443.
Lessons: Firewalls, Traffic Filtering and Segmentation
See also: Firewall, Default deny, Port number
Source: Supplementary explanation
- Firmware
The software built into a device to make its hardware work, such as the program inside a camera, printer, router or switch.
Firmware needs security updates like any other software, and devices are often left running the version they were bought with.
Lessons: Vulnerabilities and Exposure
See also: Patching, IoT, Vulnerability
Source: Supplementary explanation
- Forward secrecy (PFS)
The property that later compromise of a long-term private key does not expose the session keys of earlier connections.
It depends on ephemeral key exchange and on temporary keys being discarded. It does not protect future connections or stored data.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy
See also: Ephemeral key, ECDHE, Session key
Source: Covered in Session 9; definition expanded for the Study Guide
- Four Ts
The four classroom options for responding to a risk: Treat (mitigate), Transfer (shift specified consequences), Tolerate (accept with authority) and Terminate (stop the activity).
Transfer does not remove the vulnerability or the organisation’s accountability.
Lessons: Treating Risk
See also: Risk, Residual risk
Source: Classroom session
- Frame
The unit of data at the Data Link layer, such as an Ethernet frame. It is addressed with MAC addresses for delivery across one local link.
Lessons: OSI and TCP/IP Models, Ethernet Switching and MAC Addresses
See also: Packet, MAC address, Encapsulation
Source: Classroom session
- Frequency analysis
Breaking a substitution cipher by counting how often each symbol appears and comparing the counts with the normal letter frequencies of the language.
It tries no keys at all, which is why a huge keyspace does not save simple substitution.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Substitution cipher, Cryptanalysis, Caesar cipher
Source: Supplementary explanation
- Full-disk encryption (FDE)
Encryption of everything on a drive, including the operating system.
It protects a device that is switched off. Once the device is unlocked and running, the data is available to whoever or whatever is signed in.
Lessons: Data States and Encryption at Rest
See also: BitLocker, Self-encrypting drive, Data at rest
Source: Covered in Session 9; definition expanded for the Study Guide
- Functionality
Whether a system provides the capabilities required for its intended tasks.
Lessons: Security, Usability & Functionality
Source: Classroom session
- Gap analysis
Comparing the current state with the target state to identify the gaps, and then deciding which improvements will close them.
A score shows how much of a target is met, not what to fix first: priority depends on impact, criticality, likelihood and context.
Lessons: Gap Analysis
Source: Covered in Sessions 3 and 7; definition expanded for the Study Guide
- Governance
The direction, accountability and oversight through which an organisation sets and checks its security decisions.
Delegating implementation does not remove leadership oversight.
Lessons: Governance, Risk and Compliance (GRC)
Source: Classroom session
- GRC (Governance, Risk and Compliance)
An integrated approach connecting who sets direction and owns decisions (governance), how uncertainty is assessed and treated (risk), and which requirements must be met (compliance).
Lessons: Governance, Risk and Compliance (GRC)
See also: Governance, Risk, Compliance
Source: Classroom session
- Guideline
Recommended practice that helps people make appropriate decisions where rules do not cover every situation.
Lessons: Security Documentation
See also: Policy
Source: Classroom session
- Hacktivist
A threat actor who attacks to advance a political or social cause, to attract attention or to disrupt a perceived opponent.
Lessons: Threat Actor Types, Attributes and Motivations
See also: Threat actor
Source: Covered in Session 8; definition expanded for the Study Guide
- Hash collision
Two different inputs that produce the same digest.
Collisions must exist for every hash function, because inputs outnumber digests. A secure hash makes them infeasible to find.
Lessons: Hashing and Integrity Checking
See also: Collision resistance, Hash function, MD5
Source: Covered in Session 9; definition expanded for the Study Guide
- Hash function
A function that turns input of any size into a fixed-length digest. It is one-way and uses no key.
A hash is not encrypted data and cannot be decrypted. A small change to the input gives a completely different digest.
Lessons: Hashing and Integrity Checking, Digital Signatures, Password Storage: Salting, Stretching and Peppering, Blockchain and Hash-Linked Records
See also: Message digest, Hash collision, SHA, Encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- Hexadecimal
A base-16 number system using the digits 0–9 and the letters A–F, where A = 10 and F = 15. One hexadecimal digit represents exactly four bits.
MAC addresses and IPv6 addresses are written in hexadecimal.
Lessons: Binary, Decimal and Hexadecimal, Ethernet Switching and MAC Addresses
See also: Binary, MAC address
Source: Study Buddy session
- Host
An endpoint that sends or receives data on a network. Hosts are nodes, but not every node is an end host.
Lessons: What Is a Network?
See also: Node
Source: Classroom session
- Host-only network
A virtual network that connects a host computer and the virtual machines attached to it, without providing ordinary internet access by itself.
It limits reach but is not complete isolation: the host and other VMs on the same host-only network can still reach an attached VM, and extra adapters, forwarding or host settings can widen its reach.
Lessons: Virtual Machines, Guided Lab: Kali and Metasploitable Service Discovery
See also: Virtual machine, Hypervisor, NAT
Source: Supplementary explanation
- HSM (Hardware security module)
A dedicated, tamper-resistant device or service that generates, stores and uses keys on behalf of many systems without releasing them.
HSMs hold an organisation’s most valuable keys, such as a certificate authority’s signing keys.
Lessons: Key Management, Cryptographic Hardware and Escrow, Public Key Infrastructure and Digital Certificates
See also: TPM, Secure enclave, Private key
Source: Covered in Session 9; definition expanded for the Study Guide
- HTTP (Hypertext Transfer Protocol)
The set of rules a web browser and a website use to ask for and send pages. A browser sends a request; the website sends a response.
HTTP alone is not encrypted, so anyone on the path can read it. HTTPS is the same conversation carried inside TLS.
Lessons: HTTPS: TCP, TLS and web communication, TCP, UDP, Ports and Sockets
See also: HTTPS, TLS, Protocol, Port number
Source: Supplementary explanation
- HTTPS (Hypertext Transfer Protocol Secure)
HTTP protected by TLS. HTTP/1.1 and HTTP/2 commonly use TCP port 443, while HTTP/3 uses QUIC over UDP port 443.
Lessons: HTTPS: TCP, TLS and web communication, Transport Encryption, Key Agreement and Forward Secrecy
Source: Classroom session
- Hybrid encryption
Encrypting data with a fast symmetric key, then protecting that key with the recipient’s public key.
The data gets symmetric speed and the key gets asymmetric distribution. Most practical encryption works this way.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Data States and Encryption at Rest, Transport Encryption, Key Agreement and Forward Secrecy
See also: Symmetric encryption, Asymmetric encryption, Session key
Source: Covered in Session 9; definition expanded for the Study Guide
- Hypervisor
Software that creates and manages virtual machines and their use of the physical host’s resources.
Lessons: Virtual Machines
See also: Virtual machine, Snapshot
Source: Supplementary explanation
- IACS (Industrial Automation and Control Systems)
Industrial systems that monitor or control physical processes; they are associated with operational technology environments.
Lessons: People, Processes & Technology
See also: OT
Source: Classroom session
- IAM (Identity and Access Management)
The discipline of managing identities and what they can reach: accounts, roles, permissions, authentication and the access lifecycle.
AAA describes what happens each time someone uses a system; IAM is the management around those moments, from joining an organisation to leaving it.
Lessons: Identity and Access Management: Identification and AAA, The NIST Cybersecurity Framework
See also: AAA, Authentication, Authorisation, Least privilege
Source: Covered in Session 7; definition expanded for the Study Guide
- ICMP (Internet Control Message Protocol)
The protocol network devices use to send each other short status and error messages, such as “that destination cannot be reached”. The ping command uses it to test whether a device answers.
Lessons: OSI and TCP/IP Models
See also: Protocol, IP address, Packet
Source: Supplementary explanation
- ICO (Information Commissioner’s Office)
The UK’s independent regulator for data protection and information rights, to which notifiable personal data breaches are reported.
Lessons: Personal-Data Breaches and ICO Notification
See also: Personal data breach, UK GDPR
Source: Classroom session
- ICS (Industrial Control System)
A system that monitors or controls an industrial process, such as water treatment, power distribution or manufacturing.
ICS is a general term. SCADA systems and PLCs are parts of many industrial control systems.
Lessons: Attack Surfaces and Attack Vectors
See also: OT, SCADA, PLC, IACS
Source: Supplementary explanation
- Identification
Claiming an identity, for example by entering a username, before any proof has been given.
It is the first step of the access-control flow. It comes before AAA and is not one of the three As.
Lessons: Identity and Access Management: Identification and AAA
See also: Authentication, AAA
Source: Covered in Session 7; definition expanded for the Study Guide
- Impact
How serious the consequences of an event would be for the organisation and the people affected.
High impact alone does not make a high risk; likelihood and context also matter.
Lessons: Risk, Assessing Risk, Threat Actor Types, Attributes and Motivations
See also: Likelihood, Risk, BIA
Source: Classroom session
- Impersonation
Pretending to be someone the target trusts, such as a colleague, a manager, IT support or a supplier.
Impersonation is who the attacker pretends to be; pretexting is the story they tell.
Lessons: Social Engineering and Phishing
See also: Pretexting, Social engineering
Source: Covered in Session 8; definition expanded for the Study Guide
- Information owner
The person accountable for a set of information, who decides its classification and who may access it.
The owner makes decisions about the information; IT staff usually implement them.
Lessons: Data Classification
See also: Data classification, Least privilege
Source: Supplementary explanation
- Information security
Protecting information by bringing together policies, processes and technical controls throughout the information’s lifecycle.
Lessons: People, Processes & Technology
See also: People, processes and technology, CIA triad
Source: Classroom session
- Inherent risk
Risk assessed before the controls being evaluated are taken into account.
Lessons: Treating Risk
See also: Residual risk, Control
Source: Classroom session
- Insider threat
The possibility of harm from someone with legitimate, trusted access to an organisation’s systems or information, whether they act deliberately or by mistake.
Insider describes the access relationship. Malicious or unintentional describes intent, which is a separate question.
Lessons: Threat Actor Types, Attributes and Motivations
See also: Malicious insider, Threat actor
Source: Covered in Session 8; definition expanded for the Study Guide
- Integrity
The security objective of keeping information accurate and complete by protecting it from unauthorised or improper modification.
Fictional example: A booking date changed without authorisation is an integrity failure, even if nobody else saw the record.
Lessons: CIA Triad, Non-Repudiation, Hashing and Integrity Checking, Digital Signatures
See also: CIA triad, Alteration, Non-repudiation
Source: Classroom session
- Intermediate CA
A certificate authority whose certificate is signed by a root, and which signs the certificates issued to end users.
Intermediates do the daily work so that the root’s key can stay offline, and one can be revoked without replacing the root.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Root certificate, Leaf certificate, Certificate chain
Source: Covered in Session 9; definition expanded for the Study Guide
- Internal reconnaissance
An attacker exploring an environment after gaining an initial foothold, to discover systems, accounts, permissions and valuable information.
Discovering a resource does not grant permission to use it; that still depends on the account’s access.
Lessons: Attack Chain
See also: Attack chain, Privilege escalation
Source: Classroom session
- IoT (Internet of Things)
Everyday physical devices, such as cameras, sensors and smart appliances, that connect to a network or the internet.
Lessons: Vulnerabilities and Exposure
Source: Classroom session
- IP address
A logical network-layer address identifying an interface for delivery across networks. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
Lessons: IPv4 and IPv6 Addresses, IP forwarding, default gateways and NAT/PAT
See also: CIDR, MAC address, Private IPv4 address, Octet, Loopback address
Source: Classroom session
- ISMS (Information Security Management System)
A scoped management system of policies, processes, controls and review through which an organisation manages information security.
Lessons: Security Frameworks and Standards
See also: ISO/IEC 27001, PDCA
Source: Classroom session
- ISO/IEC 27001
The international standard specifying requirements for an ISMS within a defined scope. Organisations can be certified against it.
ISO/IEC 27002 gives guidance on controls. Neither standard certifies that every attack is prevented.
Lessons: Security Frameworks and Standards
See also: ISMS, Statement of Applicability
Source: Classroom session
- ISSO (Information Systems Security Officer)
The person responsible for the security of particular information systems: that their controls are in place and that their documentation, risks and remediation are managed.
It is an individual role, not a team, and it is system-focused where a CISO looks across the whole organisation. NIST, the United States National Institute of Standards and Technology, writes the title as information system security officer.
Lessons: Security Roles and Responsibilities, Security Teams and Competencies
Source: Covered in Session 7; definition expanded for the Study Guide
- Kerckhoffs’s principle
The rule that a cryptographic system should stay secure when everything about it except the key is public.
Security rests on keeping the key secret, not on hiding the algorithm.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Cryptographic key, Cipher
Source: Covered in Session 9; definition expanded for the Study Guide
- Key distribution
Getting a cryptographic key to the party who needs it without exposing it on the way.
It is the main difficulty of symmetric encryption, and the problem that asymmetric encryption and key agreement solve.
Lessons: Symmetric, Asymmetric and Hybrid Encryption
See also: Symmetric encryption, Asymmetric encryption, Key exchange
Source: Covered in Session 9; definition expanded for the Study Guide
- Key escrow
Placing a copy of a key with a trusted party, so that data can be recovered if the key or its holder is unavailable.
The escrowed copy is another copy to protect, so access to it must be controlled and recorded.
Lessons: Key Management, Cryptographic Hardware and Escrow, Data States and Encryption at Rest
See also: M-of-N control, Cryptographic key
Source: Covered in Session 9; definition expanded for the Study Guide
- Key exchange
Any method by which two parties come to share a secret key over a network that others can observe.
In key transport, one side sends the secret encrypted; in key agreement, such as Diffie-Hellman, both sides compute the same secret and it is never sent.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy, Symmetric, Asymmetric and Hybrid Encryption
See also: ECDHE, Ephemeral key, Session key
Source: Covered in Session 9; definition expanded for the Study Guide
- Key length
The number of bits in a key. Each added bit doubles the number of possible keys.
Key lengths can be compared only between algorithms of the same kind: a 2048-bit RSA key is weaker than a 256-bit AES key.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Symmetric, Asymmetric and Hybrid Encryption
See also: Keyspace, Brute-force attack
Source: Covered in Session 9; definition expanded for the Study Guide
- Key management
Looking after cryptographic keys for their whole lives: generating, distributing, storing, using, rotating, backing up, revoking and destroying them.
It can be centralised in one key management system or left to each system and person. Most real cryptographic failures are failures of key management, not of algorithms.
Lessons: Key Management, Cryptographic Hardware and Escrow
See also: Key management system, Key rotation, Key escrow
Source: Covered in Session 9; definition expanded for the Study Guide
- Key management system (KMS)
A dedicated system that generates, stores, rotates and issues keys for an organisation’s applications and devices.
Centralising keys gives one place to apply policy and to audit use, and makes that system a very valuable target.
Lessons: Key Management, Cryptographic Hardware and Escrow
See also: KMIP, HSM, Key rotation
Source: Supplementary explanation
- Key pair
The two related keys used in asymmetric cryptography: a public key and a private key. What one does, only the other can undo.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Digital Signatures
See also: Public key, Private key
Source: Covered in Session 9; definition expanded for the Study Guide
- Key rotation
Replacing a key with a new one, on a planned schedule or at once after suspected exposure.
It limits how much data any one key protects and how long a stolen key stays useful.
Lessons: Key Management, Cryptographic Hardware and Escrow
See also: Cryptographic key, Key escrow
Source: Supplementary explanation
- Key stretching
Deliberately making each password hash slow or memory-intensive to compute, so that large-scale guessing becomes expensive.
Lessons: Password Storage: Salting, Stretching and Peppering
See also: Salt, Pepper, Password hashing
Source: Covered in Session 9; definition expanded for the Study Guide
- Keyspace
The number of possible keys for a cipher. A key of n bits has 2 to the power n possible values.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Key length, Brute-force attack
Source: Covered in Session 9; definition expanded for the Study Guide
- KMIP (Key Management Interoperability Protocol)
A standard protocol that lets applications and devices from different vendors communicate with a key management server.
Lessons: Key Management, Cryptographic Hardware and Escrow
See also: Key management system
Source: Covered in Session 9; definition expanded for the Study Guide
- LAN (Local Area Network)
A network covering a local area such as a home, office or building. Network scopes are general descriptions, not fixed distance limits.
Lessons: What Is a Network?
See also: WAN, Switch, PAN, MAN
Source: Classroom session
- Lawful basis
A legal ground under Article 6 of the UK GDPR that must fit the purpose before personal data is processed.
Session 3 taught six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Current UK law also includes recognised legitimate interest for specified conditions.
Lessons: Data Protection: UK GDPR and the DPA 2018
See also: UK GDPR, Special category data
Source: Classroom session
- Leaf certificate
The certificate at the end of a chain, issued to a server, person or device. It cannot sign other certificates.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Intermediate CA, Certificate chain
Source: Covered in Session 9; definition expanded for the Study Guide
- Least privilege
Granting users, processes and systems only the access necessary to perform their authorised functions.
Example: Use a standard account for everyday work and reserve administrative permissions for tasks that need them.
Lessons: Least Privilege, Identity and Access Management: Identification and AAA
See also: Authorisation, Need to know, Separation of duties, Privilege escalation, IAM
Source: Classroom session
- Ledger
A record of transactions: who paid whom, who owns what, and in what order things happened.
Traditionally one trusted organisation keeps it. A blockchain is a ledger that many participants hold and none can quietly rewrite.
Lessons: Blockchain and Hash-Linked Records
See also: Blockchain, Open public ledger
Source: Supplementary explanation
- Likelihood
How probable it is that a defined event will happen over a stated period.
Session 2 used “probability” for the same idea. A likelihood rating needs a time period and defined criteria to mean anything.
Lessons: Risk, Assessing Risk, Threat Actor Types, Attributes and Motivations
See also: Impact, Risk, Risk matrix
Source: Classroom session
- Living off the land (LOTL)
Using legitimate tools and features already present in the victim’s environment, instead of relying solely on custom malware.
Because the activity uses ordinary administrative tools, it can resemble normal administration and is harder to tell apart from legitimate work.
Lessons: Nation-State Actors, APTs and MITRE ATT&CK
Source: Covered in Session 8; definition expanded for the Study Guide
- Load balancing
Distributing incoming traffic or requests across several systems so that no single system is overwhelmed.
It spreads permitted work; it does not remove attack traffic or add capacity to a shared bottleneck such as a database or upstream link.
Lessons: Distributed Denial of Service (DDoS)
See also: DDoS, Rate limiting
Source: Classroom session
- Long-term key
A key that stays the same for months or years, such as the private key belonging to a certificate. Its opposite is an ephemeral key.
With forward secrecy, stealing a long-term key does not expose the session keys of earlier connections.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy
See also: Ephemeral key, Forward secrecy, Private key
Source: Supplementary explanation
- Loopback address
An address a device uses to send traffic to itself, such as 127.0.0.1 in IPv4 or ::1 in IPv6.
Lessons: IPv4 and IPv6 Addresses, Inspecting Network Configuration: Windows, Linux and VyOS
See also: IP address
Source: Classroom session
- M-of-N control
Splitting the authority to recover or use a key among N people, so that any M of them must act together.
No one person can act alone, and some absences can be tolerated.
Lessons: Key Management, Cryptographic Hardware and Escrow
See also: Key escrow, Separation of duties
Source: Covered in Session 9; definition expanded for the Study Guide
- MAC address (MAC: Media Access Control)
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
Lessons: Ethernet Switching and MAC Addresses, DHCP and ARP, Inspecting Network Configuration: Windows, Linux and VyOS, MAC Flooding and Port Security, What Is a Network?
See also: ARP, Switch, Hexadecimal, MAC address table, MAC spoofing
Source: Classroom session
- MAC address table
The table in which a switch records which MAC addresses it has learned on which ports, so that it can forward frames selectively.
Lessons: Ethernet Switching and MAC Addresses, MAC Flooding and Port Security
See also: Switch, MAC address, MAC flooding, Unknown unicast flooding
Source: Classroom session
- MAC flooding
Sending frames with many different source MAC addresses to exhaust a switch’s MAC address table. This increases flooding of unknown unicast traffic within the VLAN.
The switch does not literally become a hub; known destinations may still be forwarded normally.
Lessons: MAC Flooding and Port Security
See also: Port security, Switch, MAC address, Unknown unicast flooding
Source: Classroom session
- MAC spoofing
Making a network interface use a MAC address other than its own, such as the address of another device.
Because MAC addresses can be changed in software, a MAC address identifies an interface for delivery but does not prove which device is connected.
Lessons: MAC Flooding and Port Security
See also: MAC address, Port security
Source: Classroom session
- Malicious insider
A person with legitimate access who deliberately misuses it, for example for personal gain or because of a grievance.
Mistakes by staff are not malicious, and an account name in a log does not prove who acted or why.
Lessons: Threat Actors, Threat Actor Types, Attributes and Motivations
See also: Threat actor
Source: Supplementary explanation
- Malware
Malicious software designed to disrupt, damage or gain unauthorised access to devices, networks or data. Ransomware is one type.
Lessons: Defence in Depth
See also: Ransomware
Source: Classroom session
- MAN (Metropolitan Area Network)
A network covering a city or metropolitan area, such as one linking buildings across a city.
Lessons: What Is a Network?
Source: Classroom session
- Managerial control
A control that works through governance, oversight, policy and risk management, such as a security policy or a risk assessment.
The category means the governance mechanisms, not the managers themselves. Some frameworks call these management controls.
Lessons: Security Controls: Categories and Functions
See also: Control, Operational control, Technical control, Physical control, Administrative control
Source: Covered in Session 7; definition expanded for the Study Guide
- MD5 (Message Digest 5)
An older hash function with a 128-bit digest. Collisions for it can be produced in seconds.
It is not suitable where collision resistance matters, such as digital signatures and certificates.
Lessons: Hashing and Integrity Checking
See also: Hash function, SHA, Hash collision
Source: Covered in Session 9; definition expanded for the Study Guide
- Message digest
The fixed-length output of a hash function: a short fingerprint of the input.
Lessons: Hashing and Integrity Checking, Digital Signatures, Password Storage: Salting, Stretching and Peppering, Blockchain and Hash-Linked Records
See also: Hash function, Checksum
Source: Covered in Session 9; definition expanded for the Study Guide
- MITRE ATT&CK (ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge)
A free, public knowledge base, maintained by MITRE, of the tactics and techniques that real adversaries have been observed using.
It is a reference for describing and understanding adversary behaviour, not a product that blocks attacks.
Lessons: Nation-State Actors, APTs and MITRE ATT&CK
See also: Tactic, Technique, APT
Source: Covered in Session 8; definition expanded for the Study Guide
- MTU (Maximum Transmission Unit)
The largest packet a link can carry without splitting it up. A typical Ethernet MTU is 1,500 bytes, not counting the Ethernet header and trailer.
Lessons: OSI and TCP/IP Models
See also: Encapsulation, Packet
Source: Study Buddy session
- Multi-factor authentication (MFA)
Authentication that requires two or more different types of factor, such as something you know and something you have.
MFA methods do not all provide the same protection, and MFA does not correct overly broad permissions.
Lessons: Security, Usability & Functionality, Least Privilege, Defence in Depth, Attack Chain, Identity and Access Management: Identification and AAA
See also: Authentication, Authentication factor
Source: Supplementary explanation
- Multicast
Communication sent to a selected group of recipients.
Lessons: Unicast, Multicast, Broadcast and Anycast
See also: Unicast, Broadcast, Anycast
Source: Classroom session
- Mutual TLS (mTLS)
TLS in which both ends prove their identity with certificates, not only the server.
It is used between systems, for example two organisations’ services, where each must know exactly what it is talking to.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy
See also: TLS, Digital certificate, Authentication
Source: Supplementary explanation
- NAT (Network Address Translation)
Translating IP addresses as traffic passes a device, commonly so that devices with private addresses can use a public-facing address.
Translation changes addressing; it is not a firewall policy deciding which traffic is allowed.
Lessons: IP forwarding, default gateways and NAT/PAT, Firewalls, Traffic Filtering and Segmentation
See also: PAT, Private IPv4 address, Firewall
Source: Classroom session
- Nation-state actor
A threat actor that is part of a government or sponsored by one, typically pursuing espionage, strategic advantage, disruption or influence.
Often very capable and well resourced, though not unlimited. Nation-state says who is behind the activity; it is not a motivation, and it is not a synonym for APT.
Lessons: Nation-State Actors, APTs and MITRE ATT&CK, Threat Actor Types, Attributes and Motivations
See also: APT, Threat actor
Source: Covered in Session 8; definition expanded for the Study Guide
- Need to know
The principle that a person should access particular information only where their role gives a legitimate requirement for it.
Lessons: Least Privilege
See also: Least privilege, Separation of duties
Source: Supplementary explanation
- Neighbour Discovery (NDP: Neighbour Discovery Protocol)
The IPv6 mechanism, using ICMPv6 messages, that finds neighbouring devices and their link-layer addresses. It replaces ARP in IPv6.
Lessons: IPv4 and IPv6 Addresses, DHCP and ARP
See also: ARP
Source: Classroom session
- Network address
The first address of a subnet, with all host bits set to 0. It identifies the network itself rather than any one device.
It is found by combining an address with its subnet mask using binary AND.
Lessons: Subnetting: Network, Broadcast and Usable Addresses, Classful Addressing, Subnet Masks and CIDR
See also: Broadcast address, Subnet mask
Source: Study Buddy session
- Network service
A program or function that can be reached over the network, listening for and responding to requests on an address and port.
Web, remote-login and DNS servers are examples. A service can run on a non-standard port, so a port number alone does not prove which service is running.
Lessons: Service Discovery and Vulnerability Research
See also: Port number, Nmap, Socket
Source: Supplementary explanation
- NIC (Network Interface Card)
Hardware that connects a device to a network medium and provides Physical and Data Link layer functions.
Lessons: What Is a Network?
See also: MAC address
Source: Classroom session
- NIST CSF (CSF: Cybersecurity Framework)
A framework organising cybersecurity outcomes into Functions: six in version 2.0 (Govern, Identify, Protect, Detect, Respond and Recover), and five, without Govern, in earlier versions.
Session 3 taught the five-function sequence of the earlier framework; Session 4 recorded the six-function CSF 2.0. The Functions are connected, ongoing outcomes, not a one-pass sequence.
Lessons: Security Frameworks and Standards, The NIST Cybersecurity Framework, Gap Analysis
See also: Cyber Essentials, Gap analysis
Source: Classroom session
- Nmap
A network scanning tool used for network exploration and security auditing: finding which hosts respond, which ports are open and which services are behind them.
Its -sV option performs service and version detection. A detected service or version is evidence to interpret, not proof that a system is vulnerable, and scanning needs authorisation.
Lessons: Service Discovery and Vulnerability Research, Guided Lab: Kali and Metasploitable Service Discovery
See also: Port number, Network service, CVE
Source: Supplementary explanation
- Node
Any device or connection point that participates in a network.
Lessons: What Is a Network?
See also: Host
Source: Classroom session
- Non-repudiation
Evidence that an action or communication took place and of who performed it, strong enough that the person cannot credibly deny it.
It is an additional security property, not part of the CIA triad. It provides evidence of who acted and does not itself prevent modification.
Fictional example: A valid digital signature on a contract is evidence that the supplier signed it, so a later denial is hard to believe.
Lessons: Non-Repudiation, CIA Triad, Digital Signatures
See also: Integrity, CIA triad, Digital signature, Audit log, Accounting
Source: Covered in Session 7; definition expanded for the Study Guide
- NVD (National Vulnerability Database)
A database maintained by NIST that provides information about publicly disclosed vulnerabilities.
Its entries are built on CVE records and can add a description, the affected products, a CVSS severity score and references to fixes. Analysis is not always immediate, so a new record may not yet be scored.
Lessons: Vulnerabilities and Exposure
See also: Vulnerability, CVE, CVSS, Zero-day vulnerability
Source: Classroom session
- Obfuscation
Making data harder to understand, find or misuse, without necessarily encrypting it. Steganography, data masking and tokenisation are forms of it.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: Steganography, Data masking, Tokenisation
Source: Supplementary explanation
- OCSP (Online Certificate Status Protocol)
A protocol that lets a client ask a certificate authority’s responder for the current status of one certificate.
The answer is fresher than a list, but the query reveals which certificate is being checked and can fail or be blocked.
Lessons: Certificate Validity and Revocation: CRLs and OCSP
See also: CRL, Certificate revocation
Source: Covered in Session 9; definition expanded for the Study Guide
- Octet
A group of eight bits, which can hold a value from 0 to 255. An IPv4 address is made of four octets.
IPv4 addresses are written in dotted decimal: each octet as a decimal number, separated by dots.
Lessons: Binary, Decimal and Hexadecimal, IPv4 and IPv6 Addresses
See also: Binary, IP address
Source: Study Buddy session
- Offline attack
Guessing passwords against a stolen copy of the stored hashes, on the attacker’s own hardware, where no sign-in page can slow the guesses or lock an account.
Salting and key stretching are the defences. Rate limiting and lockout affect only online attacks, made against the live sign-in page.
Lessons: Password Storage: Salting, Stretching and Peppering
See also: Password hashing, Brute-force attack, Key stretching
Source: Supplementary explanation
- Open public ledger
A ledger that anyone can read and anyone may join to help validate new entries, with no permission needed.
A permissioned or private blockchain, by contrast, restricts who may read, write or validate.
Lessons: Blockchain and Hash-Linked Records
See also: Blockchain
Source: Supplementary explanation
- Operating system (OS)
The software that runs a computer and lets other programs use it. Windows, macOS, Linux, Android and iOS are operating systems.
Applications run on top of the operating system, so a weakness in it can expose every program and file on the device.
Lessons: People, Processes & Technology
See also: Server, Patching, Virtual machine
Source: Supplementary explanation
- Operational control
A control carried out primarily by people following processes, such as security awareness training or an incident-response procedure.
Lessons: Security Controls: Categories and Functions
See also: Control, Managerial control, Technical control, Physical control, Administrative control
Source: Covered in Session 7; definition expanded for the Study Guide
- OSI model (OSI: Open Systems Interconnection)
A conceptual seven-layer reference model for describing networking functions: Application, Presentation, Session, Transport, Network, Data Link and Physical.
Real protocols do not map exactly onto one layer each; the model is a way to reason about functions.
Lessons: OSI and TCP/IP Models
See also: Encapsulation, Protocol, TCP/IP model
Source: Classroom session
- OT (Operational Technology)
Systems that monitor or control physical equipment and processes, such as in manufacturing, transport or utilities.
Security decisions in OT can affect physical operations and safety as well as information.
Lessons: People, Processes & Technology, Non-Repudiation, Attack Surfaces and Attack Vectors
See also: IACS
Source: Classroom session
- Packet
The unit of data at the Network layer, such as an IP packet. It carries source and destination IP addresses between networks.
Lessons: OSI and TCP/IP Models
See also: Frame, Segment, IP address
Source: Classroom session
- PAN (Personal Area Network)
A network around one person, such as a phone connected to wireless headphones.
Lessons: What Is a Network?
See also: LAN
Source: Classroom session
- Partition encryption
Encryption of one partition or volume of a drive, leaving the rest of the drive as it was.
A volume is a storage area that the operating system treats as one drive. Encrypting every volume on a disk amounts to encrypting the disk.
Lessons: Data States and Encryption at Rest
See also: Full-disk encryption, BitLocker, Data at rest
Source: Covered in Session 9; definition expanded for the Study Guide
- Password hashing
Storing the output of a purpose-built scheme, which salts and stretches each password, instead of the password itself.
Argon2id, scrypt, bcrypt and PBKDF2 are password-hashing schemes. A single fast hash such as SHA-256 is not.
Lessons: Password Storage: Salting, Stretching and Peppering
See also: Salt, Key stretching, Pepper, Hash function
Source: Covered in Session 9; definition expanded for the Study Guide
- PAT (Port Address Translation)
NAT that also maps port numbers, so many private devices can share one public-facing address.
Lessons: IP forwarding, default gateways and NAT/PAT
See also: NAT, Port number
Source: Classroom session
- Patching
Applying updates from a software vendor that fix known vulnerabilities or other flaws.
A patch removes the specific weaknesses it fixes. It does not correct excessive permissions or stop a stolen account using functions it is allowed to use.
Lessons: Defence in Depth, Vulnerabilities and Exposure, Attack Surfaces and Attack Vectors
See also: Vulnerability, Zero-day vulnerability
Source: Classroom session
- PCI DSS (Payment Card Industry Data Security Standard)
The payment-card industry security standard for environments that store, process or transmit payment-card data. It does not replace data-protection law.
Lessons: Security Frameworks and Standards
See also: Compliance
Source: Classroom session
- PDCA (Plan–Do–Check–Act)
A continual-improvement cycle: plan objectives and controls, do the implementation, check the results, and act on gaps.
Lessons: Security Frameworks and Standards
See also: ISMS
Source: Classroom session
- Penetration test
An authorised assessment that looks for weaknesses in systems and safely demonstrates them, within an agreed scope and timeframe.
Session 2 stressed its limits: a test cannot guarantee that every vulnerability is found, and an attacker may have far more time.
Lessons: Ethics, Authorisation and Responsible Disclosure, Assurance and the Limits of Penetration Testing
See also: Testing scope, Security-testing authorisation, Assurance
Source: Classroom session
- People, processes and technology
The idea that effective security depends on trained, responsible people, repeatable processes and supporting technical controls working together.
Session 2 stressed that technical standards and controls can only achieve so much if people are not properly trained.
Lessons: People, Processes & Technology
See also: Information security, Defence in depth
Source: Classroom session
- Pepper
A secret value added to every password before hashing and stored apart from the password database.
Unlike a salt, it is secret and the same for every password. It makes a stolen database alone insufficient to test guesses.
Lessons: Password Storage: Salting, Stretching and Peppering
See also: Salt, HSM, Key stretching
Source: Covered in Session 9; definition expanded for the Study Guide
- Permissioned blockchain
A blockchain that restricts who may read it, submit transactions or validate blocks, as its operators decide.
It shows that a blockchain is not necessarily a public ledger.
Lessons: Blockchain and Hash-Linked Records
See also: Blockchain, Open public ledger
Source: Supplementary explanation
- Personal data
Information relating to an identified or identifiable living individual.
Removing names does not automatically anonymise information; pseudonymised information remains personal data where people are still identifiable.
Lessons: Data Protection: UK GDPR and the DPA 2018
See also: Special category data, UK GDPR, Data subject
Source: Classroom session
- Personal data breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
The controller notifies the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people’s rights and freedoms.
Lessons: Personal-Data Breaches and ICO Notification
See also: ICO, Personal data, Security incident
Source: Classroom session
- Pharming
Redirecting users to a fraudulent destination even when they enter the correct address, classically by tampering with DNS or other name resolution.
Phishing tricks the person; pharming redirects the traffic.
Lessons: Social Engineering and Phishing
Source: Covered in Session 8; definition expanded for the Study Guide
- Phishing
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
Lessons: Attack Chain, Social Engineering and Phishing, Attack Surfaces and Attack Vectors
See also: Credential theft, Attack chain
Source: Classroom session
- Physical control
A control that protects buildings, equipment and physical access, such as a lock, a barrier, CCTV (closed-circuit television) or a badge-controlled door.
Lessons: Security Controls: Categories and Functions
See also: Control, Managerial control, Operational control, Technical control
Source: Covered in Session 7; definition expanded for the Study Guide
- PKI (Public key infrastructure)
The certificate authorities, certificates, software and policies that bind public keys to identities and manage certificates through their lives.
Lessons: Public Key Infrastructure and Digital Certificates, Certificate Validity and Revocation: CRLs and OCSP
See also: Certificate authority, Digital certificate, Trust anchor
Source: Covered in Session 9; definition expanded for the Study Guide
- Plaintext
Data in its readable form, before it is encrypted or after it has been decrypted.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding, Symmetric, Asymmetric and Hybrid Encryption
See also: Ciphertext, Encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- PLC (Programmable Logic Controller)
A rugged industrial computer that directly controls machinery, such as pumps, valves or motors, by following programmed logic.
Lessons: Attack Surfaces and Attack Vectors
Source: Supplementary explanation
- Policy
A document that sets organisational rules and expectations, defining what is and is not permitted.
Lessons: Security Documentation
See also: Standard, Procedure, Guideline
Source: Classroom session
- Port number
A 16-bit logical number that identifies a service or endpoint for TCP or UDP. It is different from a physical switch port.
Ranges: 0–1023 well-known, 1024–49151 registered and 49152–65535 dynamic or private.
Lessons: TCP, UDP, Ports and Sockets, HTTPS: TCP, TLS and web communication
Source: Classroom session
- Port security
A switch feature that limits the number of MAC addresses learned on an access port, with a defined action when the limit is exceeded.
Lessons: MAC Flooding and Port Security
See also: MAC flooding, MAC spoofing, Access port
Source: Classroom session
- Prefix length
The number of leading network bits in an address, written after a slash, such as /24.
Lessons: Classful Addressing, Subnet Masks and CIDR, Subnetting: Network, Broadcast and Usable Addresses
See also: Subnet mask, CIDR
Source: Study Buddy session
- Preimage resistance
The property that, given a digest, it is infeasible to find any input that produces it.
This is what makes a hash function one-way.
Lessons: Hashing and Integrity Checking
See also: Collision resistance, Hash function
Source: Covered in Session 9; definition expanded for the Study Guide
- Pretexting
Inventing a believable story or scenario that gives the target a reason to comply with a request.
Pretexting is the story; impersonation is who the attacker claims to be while telling it.
Lessons: Social Engineering and Phishing
See also: Impersonation, Social engineering
Source: Covered in Session 8; definition expanded for the Study Guide
- Preventative control
A control that reduces the chance of an attack or mistake succeeding, such as restricting access or filtering deceptive emails.
Preventive and preventative are two spellings of the same label; Session 7 used preventive.
Lessons: Defence in Depth, Security Controls: Categories and Functions
See also: Detective control, Responsive control, Recovery control, Defence in depth, Corrective control
Source: Supplementary explanation
- Private CA
A certificate authority that an organisation runs for itself. Only devices configured to trust its root accept the certificates it issues.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Certificate authority, Public CA, Trust store
Source: Covered in Session 9; definition expanded for the Study Guide
- Private IPv4 address
An address from the RFC 1918 blocks 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, used inside private networks rather than routed on the public internet.
Lessons: IPv4 and IPv6 Addresses, IP forwarding, default gateways and NAT/PAT
Source: Classroom session
- Private key
The half of a key pair that its owner keeps secret. It decrypts data sent to the owner and creates the owner’s signatures.
It should never be shared, and cannot feasibly be worked out from the public key.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Digital Signatures, Public Key Infrastructure and Digital Certificates
See also: Public key, Key pair, HSM
Source: Covered in Session 9; definition expanded for the Study Guide
- Privilege escalation
Gaining greater permissions or access than originally held, for example through additional credentials, a vulnerability or a misconfiguration.
Using a permission an account already has is not privilege escalation.
Lessons: Attack Chain, Least Privilege
See also: Least privilege, Attack chain
Source: Classroom session
- Procedure
Step-by-step instructions explaining how a particular task should be carried out.
Lessons: Security Documentation
Source: Classroom session
- Processor
An organisation that processes personal data on a controller’s behalf.
Lessons: Data Protection: UK GDPR and the DPA 2018
See also: Controller
Source: Supplementary explanation
- Protocol
An agreed set of rules for how data is formatted, transmitted and interpreted so that devices can communicate.
Lessons: What Is a Network?
See also: OSI model
Source: Classroom session
- Pseudonymisation
Replacing identifiers with codes while a separately held key can link the codes back to individuals.
Pseudonymised data is still personal data.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: De-identification, Anonymisation, Personal data
Source: Supplementary explanation
- Public CA
A certificate authority whose root certificate is already trusted by operating systems and browsers, so that its certificates are accepted by any visitor.
A certificate from one is also called a third-party certificate. Public CAs follow published industry rules and are audited.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Certificate authority, Private CA, Trust store
Source: Covered in Session 9; definition expanded for the Study Guide
- Public key
The half of a key pair that can be given to anyone. It encrypts data for the key’s owner and verifies the owner’s signatures.
A public key carries no name. A certificate is what binds it to an identity.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Digital Signatures, Public Key Infrastructure and Digital Certificates
See also: Private key, Key pair, Digital certificate
Source: Covered in Session 9; definition expanded for the Study Guide
- Qualitative risk assessment
Assessing risk with descriptive ratings, such as Low, Medium and High, often shown in a risk matrix.
Assigning numbers to the ratings can help ranking, but does not turn them into measured probabilities or money.
Lessons: Assessing Risk
See also: Quantitative risk assessment, Risk matrix
Source: Classroom session
- Quantitative risk assessment
Assessing risk with numerical estimates that have real units, such as pounds lost per incident and incidents per year.
SLE, ARO and ALE are one quantitative method. The results are only as reliable as the estimates behind them.
Lessons: Assessing Risk, Quantifying Impact: ALE and Business Impact Analysis
See also: Qualitative risk assessment, ALE
Source: Classroom session
- Rainbow table
A precomputed table for reversing unsalted hashes of likely passwords.
A unique salt for each password defeats it.
Lessons: Password Storage: Salting, Stretching and Peppering, Hashing and Integrity Checking
See also: Salt, Brute-force attack, Hash function
Source: Covered in Session 9; definition expanded for the Study Guide
- Ransomware
Malicious software that denies access to systems or data, typically by encrypting them, in order to extort payment. Some incidents also involve data theft.
Lessons: Attack Chain
See also: Data exfiltration, Denial, Malware
Source: Supplementary explanation
- Rate limiting
Restricting how many requests or connections a source can make in a given time.
Against distributed traffic, per-source limits are less effective, and limits that are too strict can block legitimate users.
Lessons: Distributed Denial of Service (DDoS)
See also: DDoS, Load balancing
Source: Classroom session
- Re-identification
Working out who a record is about after the direct identifiers have been removed, usually by combining what remains with other information.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: De-identification, Anonymisation, Pseudonymisation
Source: Supplementary explanation
- Record-level encryption
Encryption of particular records or columns in a database, with a key that the database’s ordinary users and administrators do not hold.
It keeps chosen data from people who can query the database. The cost is complexity: encrypted fields are hard to search and sort.
Lessons: Data States and Encryption at Rest
See also: Database encryption, Data at rest
Source: Covered in Session 9; definition expanded for the Study Guide
- Recovery control
A control that restores trusted, usable operation after an incident, such as restoring from protected, tested backups.
Recovery restores availability; it cannot undo a disclosure that has already happened.
Lessons: Defence in Depth
See also: Preventative control, Detective control, Responsive control, Corrective control
Source: Supplementary explanation
- Recovery key
A separate key that unlocks an encrypted drive when the normal method cannot, for example after a hardware change. BitLocker’s is a 48-digit number.
Whoever holds it can unlock the drive, so it is stored securely, often in escrow, and replaced once it has been used.
Lessons: Key Management, Cryptographic Hardware and Escrow, Data States and Encryption at Rest
See also: BitLocker, Key escrow, TPM
Source: Supplementary explanation
- Recovery point objective (RPO)
The most data, measured as a length of time, that an organisation has decided it can afford to lose in a disruption. It sets how often backups must be taken.
Fictional example: If a day of bookings can be typed in again from paper, the recovery point objective is 24 hours and a nightly backup meets it.
Lessons: Quantifying Impact: ALE and Business Impact Analysis
See also: Recovery time objective, BIA, Availability
Source: Supplementary explanation
- Recovery time objective (RTO)
The longest time an organisation has decided it can go without an activity or system after a disruption, and so the target for getting it working again.
Fictional example: A school office can take registers on paper for two hours, so the attendance system has a recovery time objective of two hours.
Lessons: Quantifying Impact: ALE and Business Impact Analysis
See also: Recovery point objective, BIA, Availability
Source: Supplementary explanation
- Residual risk
The risk that remains after considering the demonstrated effectiveness of controls.
Planned or purchased controls should not automatically be credited with reducing risk.
Lessons: Treating Risk
See also: Inherent risk, Control
Source: Classroom session
- Responsible disclosure
Reporting a discovered vulnerability privately to the organisation that can fix it, and allowing time for a fix before any details are published.
Lessons: Ethics, Authorisation and Responsible Disclosure
See also: Vulnerability, Zero-day vulnerability
Source: Supplementary explanation
- Responsive control
A control or process that limits ongoing harm once a problem is found, such as containing a compromised account.
Some frameworks call these corrective controls.
Lessons: Defence in Depth
See also: Preventative control, Detective control, Recovery control, Corrective control
Source: Supplementary explanation
- Risk
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
Lessons: Risk, Security Controls: Categories and Functions, Threat Actor Types, Attributes and Motivations
See also: Asset, Threat, Vulnerability, Control, Likelihood, Impact
Source: Classroom session
- Risk appetite
How much risk an organisation is willing to accept in pursuit of its objectives.
Lessons: Treating Risk
See also: Risk tolerance, Risk capacity
Source: Classroom session
- Risk capacity
The maximum loss or disruption an organisation can withstand.
Lessons: Treating Risk
See also: Risk appetite, Risk tolerance
Source: Classroom session
- Risk matrix
A grid that rates likelihood against impact, often on 1 to 5 scales, to rank risks into bands.
The product of two ratings is a ranking, not a probability or a loss. The bands and their boundaries are the organisation’s choices.
Lessons: Assessing Risk
See also: Likelihood, Impact, Qualitative risk assessment
Source: Classroom session
- Risk owner
The person with the authority and accountability to manage a particular risk and to accept what remains.
A title alone does not make someone the owner of every risk; ownership and authority need to be defined.
Lessons: Treating Risk
See also: Risk register, Risk tolerance
Source: Supplementary explanation
- Risk register
A record of identified risks with their assessment, treatment, owner, residual rating and review date.
Session 3 named risk registers as a topic for further study. A register makes decisions visible; it does not replace judgement.
Lessons: Treating Risk
See also: Risk owner, Residual risk
Source: Supplementary explanation
- Risk tolerance
The threshold beyond which action or escalation becomes necessary.
Fictional example: Escalate if a service is disrupted for more than one hour.
Lessons: Treating Risk
See also: Risk appetite, Risk capacity
Source: Classroom session
- Root certificate
The self-signed certificate at the top of a certificate chain.
It is trusted because it has been placed in a device’s trust store, not because of its own signature. Its private key is kept offline.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Trust anchor, Intermediate CA, Self-signed certificate
Source: Covered in Session 9; definition expanded for the Study Guide
- Router
A device that forwards traffic between networks, for example between a private local network and the internet.
Lessons: What Is a Network?, IP forwarding, default gateways and NAT/PAT
See also: Switch, Default gateway
Source: Classroom session
- Routing table
A device’s list of destination networks and how to reach each one: through a directly connected interface or via a next-hop router.
The most specific matching route wins; the default route is used only when nothing more specific matches.
Lessons: IP forwarding, default gateways and NAT/PAT, Inspecting Network Configuration: Windows, Linux and VyOS
See also: Default route, Default gateway, Router
Source: Study Buddy session
- RSA (Rivest–Shamir–Adleman)
An asymmetric algorithm whose security rests on the difficulty of factoring the product of two large prime numbers.
It can encrypt small amounts of data and create digital signatures, using its keys differently for each. Common key lengths are 2048 bits and above.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Digital Signatures
See also: Asymmetric encryption, ECC, Key pair
Source: Covered in Session 9; definition expanded for the Study Guide
- Salt
A unique random value combined with each password before hashing and stored beside the hash.
It makes identical passwords produce different hashes and defeats precomputed tables. It does not need to be secret.
Lessons: Password Storage: Salting, Stretching and Peppering
See also: Pepper, Key stretching, Rainbow table
Source: Covered in Session 9; definition expanded for the Study Guide
- SCADA (Supervisory Control and Data Acquisition)
Systems that let operators monitor and control industrial equipment spread across a site or a region from a central point.
Lessons: Attack Surfaces and Attack Vectors
Source: Supplementary explanation
- Secure enclave
An isolated, protected area of a processor or system-on-chip that keeps keys and sensitive processing apart from the main operating system.
It helps to protect data while it is in use.
Lessons: Key Management, Cryptographic Hardware and Escrow, Data States and Encryption at Rest
See also: TPM, HSM, Data in use
Source: Covered in Session 9; definition expanded for the Study Guide
- Security incident
An event that threatens or compromises the confidentiality, integrity or availability of information or systems.
A personal data breach is a narrower category: an incident that actually affects personal data.
Lessons: Personal-Data Breaches and ICO Notification
See also: Personal data breach
Source: Supplementary explanation
- Security through obscurity
Relying on the secrecy of a design or method, instead of the secrecy of a key, to keep a system secure.
Obscurity may slow an attacker down. Kerckhoffs’s principle says it should not be the only protection.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Kerckhoffs’s principle, Cryptographic key
Source: Supplementary explanation
- Security-testing authorisation
Permission from someone with appropriate authority to carry out specified security-testing activities against particular systems, within an agreed scope.
It is different from access-control authorisation, which decides what an authenticated user or process may access or do. Having access to a system, even administrative access, does not by itself give permission to test it. Session 1 stressed obtaining this permission in writing.
Lessons: Ethics, Authorisation and Responsible Disclosure, Assurance and the Limits of Penetration Testing
See also: Authorisation, Testing scope, Penetration test, Computer Misuse Act 1990
Source: Classroom session
- Segment
The unit of data TCP creates at the Transport layer, carrying source and destination port numbers. The Network layer then places it in a packet.
Lessons: OSI and TCP/IP Models, TCP, UDP, Ports and Sockets
See also: Packet, TCP, Port number
Source: Supplementary explanation
- Segmentation
Dividing an environment into parts, with enforced rules about which communication is allowed between them.
Placing systems in a named group enforces nothing on its own; the permitted paths must be configured and checked.
Lessons: Defence in Depth, Attack Chain, Firewalls, Traffic Filtering and Segmentation
See also: Defence in depth, Firewall, VLAN
Source: Supplementary explanation
- Self-encrypting drive (SED)
A drive that encrypts everything written to it in its own hardware, with a key held inside the drive.
Lessons: Data States and Encryption at Rest
See also: Full-disk encryption, Data at rest
Source: Covered in Session 9; definition expanded for the Study Guide
- Self-signed certificate
A certificate signed with its own private key, so that no third party vouches for the identity in it.
Every root certificate is self-signed. A self-signed leaf certificate can still encrypt, but cannot prove identity, so browsers warn.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Root certificate, Certificate authority
Source: Covered in Session 9; definition expanded for the Study Guide
- Separation of duties
Dividing sensitive responsibilities so that one person cannot independently complete a whole sensitive process.
Fictional example: One employee requests a financial change and another approves it.
Lessons: Least Privilege
See also: Least privilege, Need to know
Source: Supplementary explanation
- Server
A computer, or a program running on one, whose job is to provide something to other computers: files, email, web pages or a database.
The computer that asks is called the client. A server is usually shared by many people, so a problem with it affects all of them.
Lessons: People, Processes & Technology, What Is a Network?
See also: Host, Network service, Operating system
Source: Supplementary explanation
- Session key
A symmetric key used to protect one connection or one exchange of data, and then discarded.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy, Symmetric, Asymmetric and Hybrid Encryption
See also: Ephemeral key, Symmetric encryption, Hybrid encryption
Source: Supplementary explanation
- SHA (Secure Hash Algorithm)
A group of hash-function families published by NIST. SHA-256 and SHA-512 belong to the SHA-2 family in current use.
SHA-1 has practical collisions and is being withdrawn. The number in SHA-256 is the digest length in bits.
Lessons: Hashing and Integrity Checking
See also: Hash function, MD5, Hash collision
Source: Covered in Session 9; definition expanded for the Study Guide
- Shadow IT
Technology, applications or services used for work without the organisation’s approval or management.
It usually arises because staff are trying to get their work done, not from malice. It is an organisational risk and not a threat actor in the strict sense, although some syllabus lists group it with threat actors.
Fictional example: An employee stores work files in a personal cloud-storage account because the approved process is slow.
Lessons: Threat Actor Types, Attributes and Motivations, Attack Surfaces and Attack Vectors
See also: Insider threat, Attack surface
Source: Covered in Session 8; definition expanded for the Study Guide
- Shodan
A search engine that indexes internet-connected devices and the services they expose, such as servers, networking equipment and webcams.
It records what services revealed when contacted over the internet. A result shows that a service was observed as internet-reachable when it was indexed; it does not by itself prove that the service is still reachable, compromised or vulnerable.
Lessons: Vulnerabilities and Exposure
Source: Classroom session
- SLE (Single Loss Expectancy)
The estimated loss if a particular incident happens once.
Lessons: Quantifying Impact: ALE and Business Impact Analysis
Source: Classroom session
- Smishing
Phishing carried out by SMS text message.
The name combines SMS and phishing.
Lessons: Social Engineering and Phishing, Attack Surfaces and Attack Vectors
Source: Covered in Session 8; definition expanded for the Study Guide
- Snapshot
A saved state of a virtual machine that it can later be returned to.
A snapshot is usually stored with the VM on the host, so it is not a substitute for an independent backup.
Lessons: Virtual Machines
See also: Virtual machine, Hypervisor
Source: Supplementary explanation
- SOC (Security Operations Centre)
A team that continuously monitors an organisation’s systems, detecting, analysing and investigating possible security incidents and escalating confirmed ones.
Memory aid: the SOC watches. Running one does not make breaches impossible.
Lessons: Security Teams and Competencies
See also: CIRT, DevSecOps, ISSO
Source: Covered in Sessions 4 and 7; definition expanded for the Study Guide
- Socket
A software endpoint for network communication, managed by the operating system.
A TCP connection is identified by its source and destination IP addresses and ports, together with the transport protocol.
Lessons: TCP, UDP, Ports and Sockets, HTTPS: TCP, TLS and web communication
See also: Port number, TCP
Source: Classroom session
- Soft-fail
Carrying on with a connection when a revocation check gets no answer, instead of blocking it.
Most clients behave this way, so an attacker who can block the check may still succeed with a revoked certificate.
Lessons: Certificate Validity and Revocation: CRLs and OCSP
See also: Certificate revocation, OCSP, CRL
Source: Supplementary explanation
- Spear phishing
Phishing that is targeted at a specific person or group and personalised to be convincing.
Phishing is broad; spear phishing is targeted.
Lessons: Social Engineering and Phishing
Source: Covered in Session 8; definition expanded for the Study Guide
- Special category data
Personal data needing extra protection, such as health, genetic or biometric identification data, or information revealing racial or ethnic origin, political opinions, religious beliefs or trade-union membership.
Processing it generally needs an Article 6 lawful basis and an Article 9 condition.
Lessons: Data Protection: UK GDPR and the DPA 2018
See also: Personal data, Lawful basis
Source: Supplementary explanation
- SPF (Sender Policy Framework)
An email-authentication control in which a domain publishes, in DNS, which servers are authorised to send mail on its behalf.
A receiving server checks the sending server against that list. SPF does not by itself check the From address a reader sees; DMARC adds that.
Lessons: Social Engineering and Phishing
See also: DKIM, DMARC, Email spoofing, DNS
Source: Supplementary explanation
- SSH (Secure Shell)
A protocol for signing in to another computer and typing commands on it over an encrypted connection. Administrators use it to manage servers and network devices remotely.
Lessons: TCP, UDP, Ports and Sockets
See also: Protocol, Port number, Encryption
Source: Supplementary explanation
- SSL (Secure Sockets Layer)
The obsolete predecessor of TLS. Every version of SSL is insecure and should not be used.
People still say “SSL certificate” out of habit; the certificates are the same ones, used with TLS.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy
Source: Supplementary explanation
- Standard
A document that specifies requirements or recognised practices to be met.
Lessons: Security Documentation
Source: Classroom session
- Stateful firewall
A firewall that keeps track of the connections it has allowed, so replies belonging to them are let through without a separate rule.
A stateless filter judges every packet on its own and needs rules for both directions of a connection.
Lessons: Firewalls, Traffic Filtering and Segmentation
Source: Supplementary explanation
- Statement of Applicability (SoA)
The document, required by ISO/IEC 27001, in which an organisation lists the security controls it needs, why each is included, whether it is in place, and its reason for leaving out any control in the standard’s reference list (Annex A).
It records decisions. It does not show that a listed control works.
Lessons: Security Documentation
See also: ISMS, ISO/IEC 27001
Source: Supplementary explanation
- Steganography
Hiding the existence of information inside other, ordinary-looking data such as an image.
It conceals that a message exists, whereas encryption conceals what a message says.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: Encryption, Data masking
Source: Covered in Session 9; definition expanded for the Study Guide
- Subject Alternative Name (SAN)
The certificate extension that lists every name the certificate is valid for. It is the field clients check against the name requested.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Common Name, Wildcard certificate, Digital certificate
Source: Covered in Session 9; definition expanded for the Study Guide
- Subnet
One network within a larger set of networks: a group of IP addresses that share the same network part, so that devices in it can reach each other directly without a router.
Whether two devices are in the same subnet is worked out from their IP addresses and the subnet mask.
Lessons: Classful Addressing, Subnet Masks and CIDR, Subnetting: Network, Broadcast and Usable Addresses
See also: Subnet mask, Prefix length, Network address, Router
Source: Supplementary explanation
- Subnet mask
A 32-bit value that marks which bits of an IPv4 address belong to the network (1s) and which belong to the host (0s), such as 255.255.255.0.
A mask and a prefix length describe the same boundary: 255.255.255.0 is /24.
Lessons: Classful Addressing, Subnet Masks and CIDR, Subnetting: Network, Broadcast and Usable Addresses
See also: Prefix length, CIDR, Network address
Source: Study Buddy session
- Substitution cipher
A cipher that replaces each letter or symbol of the plaintext with another, according to a fixed rule.
Simple substitution keeps the patterns of the language, so it falls to letter-frequency analysis.
Lessons: Cryptography Foundations: Ciphers, Keys and Encoding
See also: Caesar cipher, Cryptanalysis
Source: Covered in Session 9; definition expanded for the Study Guide
- SUF (Security, Usability and Functionality)
A classroom framework for weighing whether a design provides required protection, can be used effectively by its intended users and performs its required tasks.
The three considerations can involve trade-offs, but good design can also make them reinforce one another.
Lessons: Security, Usability & Functionality
See also: Usability, Functionality, Accessibility
Source: Classroom session
- Supply-chain attack
An attack that reaches its target through a supplier, service or software component the target trusts.
The attacker compromises something the target depends on, rather than attacking the target directly.
Lessons: Third-Party and Supply-Chain Risk, Attack Surfaces and Attack Vectors
See also: Third-party risk, Web skimming
Source: Supplementary explanation
- Switch
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
Lessons: What Is a Network?, Ethernet Switching and MAC Addresses, Switch Ports, VLANs and 802.1Q Trunks
See also: Router, MAC address
Source: Classroom session
- Symmetric encryption
Encryption in which the same secret key encrypts and decrypts. It is fast and suits large amounts of data.
Its difficulty is key distribution: both parties need the key, and it must reach the second party without being exposed.
Lessons: Symmetric, Asymmetric and Hybrid Encryption, Transport Encryption, Key Agreement and Forward Secrecy
See also: Asymmetric encryption, AES, Hybrid encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- Tactic
In MITRE ATT&CK, the adversary’s goal at one point in an attack: the reason for performing an action, such as Persistence.
A tactic is the why; a technique is the how.
Lessons: Nation-State Actors, APTs and MITRE ATT&CK
See also: Technique, MITRE ATT&CK
Source: Covered in Session 8; definition expanded for the Study Guide
- Tamper-evident
Built so that any change shows. A tamper-evident record does not prevent alteration; it makes alteration detectable.
Lessons: Blockchain and Hash-Linked Records
See also: Blockchain, Hash function, Integrity
Source: Supplementary explanation
- TCP (Transmission Control Protocol)
A connection-oriented transport protocol that starts connections with a SYN, SYN-ACK, ACK handshake and provides reliable, ordered delivery.
Lessons: TCP, UDP, Ports and Sockets, HTTPS: TCP, TLS and web communication
See also: UDP, Port number, Socket
Source: Classroom session
- TCP/IP model
A four-layer model of how internet communication is organised: Link, Internet, Transport and Application.
Some books describe five layers by splitting Link into Data Link and Physical. It describes the protocol suite the internet actually uses.
Lessons: OSI and TCP/IP Models
See also: OSI model, Encapsulation
Source: Supplementary explanation
- Technical control
A control implemented or enforced by technology, such as multi-factor authentication, encryption or a firewall.
Lessons: Security Controls: Categories and Functions
See also: Control, Managerial control, Operational control, Physical control
Source: Covered in Session 7; definition expanded for the Study Guide
- Technique
In MITRE ATT&CK, how an adversary achieves a tactical goal, such as creating a scheduled task in order to keep access.
A sub-technique is a more specific form of a technique.
Lessons: Nation-State Actors, APTs and MITRE ATT&CK
See also: Tactic, MITRE ATT&CK
Source: Covered in Session 8; definition expanded for the Study Guide
- Testing scope
The agreed boundaries of an authorised security test: which systems, times and techniques are allowed, and which are excluded.
Anything outside the agreed scope is unauthorised, even for someone authorised to test something else.
Lessons: Ethics, Authorisation and Responsible Disclosure
See also: Security-testing authorisation, Penetration test
Source: Classroom session
- Third-party risk
Risk an organisation inherits through its suppliers, service providers and the software or services it depends on.
A supplier’s weakness can create an attack path even when the organisation’s own controls are strong.
Lessons: Third-Party and Supply-Chain Risk
See also: Supply-chain attack, Processor
Source: Classroom session
- Threat
A potential cause of harm, such as an attacker seeking unauthorised access.
Lessons: Risk, Threat Actors, Vulnerabilities and Exposure, Security Controls: Categories and Functions, Threat Actor Types, Attributes and Motivations
See also: Vulnerability, Threat actor, Risk
Source: Supplementary explanation
- Threat actor
A person or group that may cause harm to systems or information. Threat actors are often assessed by their motivation, capability and opportunity.
Lessons: Threat Actors, Threat Actor Types, Attributes and Motivations
See also: Threat, Attack chain, Malicious insider
Source: Classroom session
- TLS (Transport Layer Security)
A protocol that protects data in transit with encryption for confidentiality and with integrity protection, and authenticates the server when certificate validation succeeds. HTTPS uses it to secure web traffic.
TLS protects content in transit; it does not by itself make a website trustworthy or hide every detail of a connection, such as the addresses of the endpoints.
Lessons: HTTPS: TCP, TLS and web communication, Transport Encryption, Key Agreement and Forward Secrecy
See also: HTTPS, Forward secrecy, Key exchange
Source: Classroom session
- TLS handshake
The opening exchange of a TLS connection, in which the two sides agree keys and the server proves its identity before any application data is sent.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy
See also: TLS, Key exchange, Digital certificate
Source: Supplementary explanation
- Token vault
The protected system that records which token stands for which original value. Looking a token up in it is the only way back to the original.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: Tokenisation
Source: Supplementary explanation
- Tokenisation
Replacing a sensitive value with a token that has no mathematical relationship to it, with the mapping held in a separately protected token vault.
It is not encryption: no key turns a token back into the original.
Lessons: Obfuscation: Steganography, Masking, Tokenisation and De-identification
See also: Data masking, Encryption
Source: Covered in Session 9; definition expanded for the Study Guide
- TPM (Trusted Platform Module)
A security chip built into one device that generates and protects keys for that device, and can release them only when the device starts in an expected state.
It does not necessarily hold every encryption key: it commonly protects a key that in turn protects others stored on the drive.
Lessons: Key Management, Cryptographic Hardware and Escrow, Data States and Encryption at Rest
See also: HSM, Secure enclave, BitLocker
Source: Covered in Session 9; definition expanded for the Study Guide
- Transport encryption
Encryption that protects data while it travels between two endpoints, so that anyone in between can neither read it nor change it unnoticed.
TLS is the standard protocol. It protects the journey only: the data is ordinary data again once it arrives.
Lessons: Transport Encryption, Key Agreement and Forward Secrecy, Data States and Encryption at Rest
See also: TLS, Data in transit, HTTPS
Source: Covered in Session 9; definition expanded for the Study Guide
- Trunk
A link between switches that carries traffic for several VLANs at once. Each frame is given a tag saying which VLAN it belongs to, in the format defined by IEEE 802.1Q.
A cable alone does not create a trunk, and a trunk does not itself route between VLANs.
Lessons: Switch Ports, VLANs and 802.1Q Trunks
See also: VLAN, Access port
Source: Supplementary explanation
- Trust anchor
A root certificate already held in a device’s trust store, from which trust in a certificate chain starts.
A chain is accepted only if it leads to a trust anchor. Which roots are in the store is a configuration decision.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Root certificate, Certificate chain
Source: Covered in Session 9; definition expanded for the Study Guide
- Trust store
The list of root certificates that a device, operating system or browser has been set up to trust. A certificate chain is accepted only if it ends at one of them.
Its contents are a configuration decision. Adding a root tells the device to trust everything that root signs.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Trust anchor, Root certificate, Certificate chain
Source: Supplementary explanation
- TTL (Time to Live)
A number carried in every IP packet that each router reduces by one. A packet whose TTL reaches zero is discarded, so that one caught in a loop cannot circulate for ever.
Lessons: IP forwarding, default gateways and NAT/PAT
See also: Packet, Router, Routing table
Source: Supplementary explanation
- Typosquatting
Registering a domain name deliberately similar to a legitimate one, so that people who mistype it, or do not notice the difference, arrive at the attacker’s site.
Typosquatting is the lookalike domain; phishing is the deceptive message. The two are often combined.
Lessons: Social Engineering and Phishing
Source: Covered in Session 8; definition expanded for the Study Guide
- UDP (User Datagram Protocol)
A connectionless transport protocol that sends datagrams without first establishing a connection or guaranteeing delivery.
DHCP uses UDP, DNS commonly does, and HTTP/3 runs over QUIC on UDP.
Lessons: TCP, UDP, Ports and Sockets, HTTPS: TCP, TLS and web communication, DHCP and ARP
See also: TCP, Port number
Source: Classroom session
- UK GDPR (UK General Data Protection Regulation)
The UK’s general data-protection law, applied alongside the Data Protection Act 2018, governing how personal data is processed.
Lessons: Data Protection: UK GDPR and the DPA 2018
See also: Personal data, Lawful basis, ICO
Source: Classroom session
- Unicast
Communication sent to one intended recipient.
Lessons: Unicast, Multicast, Broadcast and Anycast
See also: Multicast, Broadcast, Anycast
Source: Classroom session
- Unknown unicast flooding
A switch copying a frame to every other eligible port in its VLAN because it has not learned which port leads to the frame’s destination MAC address.
It is normal while a switch is still learning. MAC flooding abuses it by stopping the switch from learning legitimate addresses.
Lessons: MAC Flooding and Port Security, Ethernet Switching and MAC Addresses
See also: MAC address table, MAC flooding, Switch
Source: Classroom session
- Unskilled attacker
A threat actor with limited technical capability and resources, who relies on ready-made tools and scripts and looks for easy opportunities.
“Script kiddie” is an older, informal name for the same idea.
Lessons: Threat Actor Types, Attributes and Motivations, Nation-State Actors, APTs and MITRE ATT&CK
See also: Threat actor, APT
Source: Covered in Session 8; definition expanded for the Study Guide
- Usability
How effectively, efficiently and satisfactorily intended users can use a system to complete their tasks.
Lessons: Security, Usability & Functionality
See also: SUF, Functionality
Source: Classroom session
- Virtual machine (VM)
A software-defined computer with virtual hardware and its own guest operating system, running on resources supplied by a physical host.
Virtualisation does not guarantee isolation: network modes, shared folders and clipboard integration all need review.
Lessons: Virtual Machines
See also: Hypervisor, Snapshot
Source: Study Buddy session
- Vishing
Phishing carried out by voice call.
The name combines voice and phishing.
Lessons: Social Engineering and Phishing, Attack Surfaces and Attack Vectors
Source: Covered in Session 8; definition expanded for the Study Guide
- VLAN (Virtual Local Area Network)
A separate network created inside a switch, or a group of linked switches, by assigning each port to a numbered group. Devices in the same VLAN reach each other directly; devices in different VLANs can communicate only through a router.
A VLAN separates devices. Rules on the router or firewall that connects VLANs decide what may pass between them.
Lessons: Switch Ports, VLANs and 802.1Q Trunks, Firewalls, Traffic Filtering and Segmentation
See also: Trunk, Access port, Switch, Segmentation
Source: Supplementary explanation
- VPN (Virtual Private Network)
A protected connection across a network that is not trusted, usually the internet. Organisations use one to let a computer outside the building reach the internal network as if it were inside.
A VPN protects the connection. It does not check that the person using it should be allowed in: that depends on how they sign in, which is why a VPN that accepts a password alone is a common way in for attackers.
Lessons: Attack Chain, Threat Actor Types, Attributes and Motivations, Attack Surfaces and Attack Vectors
See also: Multi-factor authentication, Data in transit, Attack surface
Source: Supplementary explanation
- Vulnerability
A weakness that a threat may exploit.
A vulnerability is one part of the risk picture, not a complete statement of risk.
Lessons: Risk, Vulnerabilities and Exposure, Security Controls: Categories and Functions, Threat Actor Types, Attributes and Motivations, Attack Surfaces and Attack Vectors
See also: Threat, Zero-day vulnerability, Risk, Exposure, NVD
Source: Supplementary explanation
- WAN (Wide Area Network)
A network spanning a wide geographical area, such as one connecting sites or networks across regions.
Lessons: What Is a Network?
See also: LAN
Source: Classroom session
- Watering-hole attack
Compromising a website that the intended targets already visit, and waiting for them to come to it.
Spear phishing goes to the target; a watering-hole attack waits where the target already goes.
Lessons: Social Engineering and Phishing
See also: Spear phishing
Source: Covered in Session 8; definition expanded for the Study Guide
- Web application firewall (WAF: Web Application Firewall)
A control that filters requests to a web application using rules about the application-layer content of those requests.
It protects the web traffic it sees. It does not solve attacks that saturate a network link before requests reach it.
Lessons: Distributed Denial of Service (DDoS), Firewalls, Traffic Filtering and Segmentation
Source: Supplementary explanation
- Web skimming
Altering a script on a web page so that it secretly copies information users enter, such as card details, and sends it to an attacker.
Session 2 discussed the British Airways Magecart incident as an example of malicious JavaScript capturing information entered on web pages.
Lessons: Third-Party and Supply-Chain Risk
See also: Supply-chain attack
Source: Classroom session
- Whaling
Spear phishing aimed at senior or high-value individuals, such as executives or board members.
Lessons: Social Engineering and Phishing
See also: Spear phishing, Phishing
Source: Supplementary explanation
- Wildcard certificate
A certificate whose name begins with an asterisk, covering any name one level below a domain.
It is convenient, and it means one stolen private key exposes every name it covers.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Subject Alternative Name, Digital certificate
Source: Supplementary explanation
- Work factor
The setting that controls how much time or memory a password-hashing scheme uses for each hash. It is raised as computers get faster.
Lessons: Password Storage: Salting, Stretching and Peppering
See also: Key stretching, Password hashing
Source: Supplementary explanation
- X.509
The standard format for digital certificates. It sets out fields such as the subject, the issuer, the validity dates, the public key and the issuer’s signature.
Lessons: Public Key Infrastructure and Digital Certificates
See also: Digital certificate, Subject Alternative Name, Common Name
Source: Covered in Session 9; definition expanded for the Study Guide
- Zero-day exploit
Code or a technique that takes advantage of a zero-day vulnerability, while the vendor does not yet know about the flaw.
The vulnerability is the flaw; the exploit is the means of using it. Using a zero-day exploit is sometimes called a zero-day attack. Once the vendor knows about a flaw it is a known vulnerability, even if no fix is available yet.
Lessons: Vulnerabilities and Exposure
See also: Zero-day vulnerability, Vulnerability
Source: Supplementary explanation
- Zero-day vulnerability
A vulnerability that the vendor does not yet know about, so no fix has been developed when it can be exploited.
Session 2 described a zero-day more broadly, as a weakness that is unknown to the vendor or does not yet have an available fix. In professional usage, a vulnerability that has been disclosed but is not yet fixed is a known, unpatched vulnerability rather than a zero-day.
Lessons: Risk, Vulnerabilities and Exposure
See also: Vulnerability, Zero-day exploit, NVD, Patching
Source: Classroom session
Manipulating people, by exploiting trust and human psychology, into doing something that helps an attacker, such as revealing a password or making a payment.
It targets the human, not just the technology.
Lessons: Social Engineering and Phishing, Attack Surfaces and Attack Vectors
See also: Phishing, Pretexting, Impersonation
Source: Covered in Session 8; definition expanded for the Study Guide