Cybersecurity Terminology

access

- The ability and means to communicate with or otherwise interact with a system, to use system resources to handle information, to gain knowledge of the information the system contains, or to control system components and functions.

access control

- The process of granting or denying specific requests for or attempts to: 1) obtain and use information and related information processing services; and 2) enter specific physical facilities.

access control mechanism

- Security measures designed to detect and deny unauthorized access and permit authorized access to an information system or a physical facility.

active attack

- An actual assault perpetrated by an intentional threat source that attempts to alter a system, its resources, its data, or its operations.

active content

- Software that is able to automatically carry out or trigger actions without the explicit intervention of a user.

advanced persistent threat

- An adversary that possesses sophisticated levels of expertise and significant resources which allow it to create opportunities to achieve its objectives by using multiple attack vectors (e.g., cyber, physical, and deception).

adversary

- An individual, group, organization, or government that conducts or has the intent to conduct detrimental activities.

AIaaS (Artificial Intelligence as a Service)

- a cloud-based service offering artificial intelligence (AI) outsourcing

air gap

- To physically separate or isolate a system from other systems or networks (verb).

alert

- A notification that a specific attack has been detected or directed at an organization’s information systems.

all source intelligence

- In the NICE Framework, cybersecurity work where a person: Analyzes threat information from multiple sources, disciplines, and agencies across the Intelligence Community. Synthesizes and places intelligence information in context; draws insights about the possible implications.

allowlist

- A list of entities that are considered trustworthy and are granted access or privileges.

analyze

- A NICE Framework category consisting of specialty areas responsible for highly specialized review and evaluation of incoming cybersecurity information to determine its usefulness for intelligence.

anonymizers

- an anonymous proxy is a tool that attempts to make activity on the Internet untraceable

anti-CSRF (Anti – Cross-Site Request Forgery)

- related pairs of tokens given to users to validate their requests and prevent issue requests from attackers via the victim

antispyware software

- A program that specializes in detecting and blocking or removing forms of spyware.

antivirus software

- A program that monitors a computer or network to detect or identify major types of malicious code and to prevent or contain malware incidents. Sometimes by removing or neutralizing the malicious code.

AppSec

- the process of finding, fixing, and preventing security vulnerabilities at the application level, as part of the software development processes

asset

- A person, structure, facility, information, and records, information technology systems and resources, material, process, relationships, or reputation that has value.

attack

- An attempt to gain unauthorized access to system services, resources, or information, or an attempt to compromise system integrity.

attack method

- The manner or technique and means an adversary may use in an assault on information or an information system.

attack path

- The steps that an adversary takes or may take to plan, prepare for, and execute an attack.

attack pattern

- Similar cyber events or behaviors that may indicate an attack has occurred or is occurring, resulting in a security violation or a potential security violation.

attack signature

- A characteristic or distinctive pattern that can be searched for or that can be used in matching to previously identified attacks.

attack surface

- The set of ways in which an adversary can enter a system and potentially cause damage.

attacker

- An individual, group, organization, or government that executes an attack.

authentication

- The process of verifying the identity or other attributes of an entity (user, process, or device).

authenticity

- A property achieved through cryptographic methods of being genuine and being able to be verified and trusted, resulting in confidence in the validity of a transmission, information or a message, or sender of information or a message.

authorization

- A process of determining, by evaluating applicable access control information, whether a subject is allowed to have the specified types of access to a particular resource.

availability

- The property of being accessible and usable upon demand.

Backdoor

- A backdoor refers to any method by which authorized and unauthorized users are able to get around normal security measures and gain high level user access (aka root access) on a computer system, network, or software application

BCrypt

- password-hashing function based on the Blowfish cipher and presented at USENIX in 1999

behavior

- the extent to which an individual practices several types of cybersecurity measures to avoid or attenuate the types of cyber threats that they are vulnerable to

blackbox

- a form of testing that is performed with no knowledge of a target system's internals

blocklist

- A list of entities that are blocked or denied privileges or access.

blue Team

- A group that defends an enterprise's information systems when mock attackers (i.e., the Red Team) attack, typically as part of an operational exercise conducted according to rules established and monitored by a neutral group (i.e., the White Team).

bluejacking

- an attack in which someone sends unsolicited messages to a Bluetooth-enabled device

bluesnarfing

- a hacking technique in which a hacker accesses a wireless device through a Bluetooth connection

bot

- A computer connected to the Internet that has been surreptitiously / secretly compromised with malicious logic to perform activities under remote the command and control of a remote administrator.

bot master

- The controller of a botnet that, from a remote location, provides direction to the compromised computers in the botnet.

botnet

- A collection of computers compromised by malicious code and controlled across a network.

bruteforce

- an attack is a method that uses trial and error to crack passwords, login credentials, and encryption keys

bug

- An unexpected and relatively small defect, fault, flaw, or imperfection in an information system or device.

build security in

- A set of principles, practices, and tools to design, develop, and evolve information systems and software that enhance resistance to vulnerabilities, flaws, and attacks.

capability

- The means to accomplish a mission, function, or objective.

Catphish

- the fabrication of a false online identity by a cybercriminal for the purposes of deception, fraud, or exploitation

ciphertext

- Data or information in its encrypted form.

cloud computing

- A model for enabling on-demand network access to a shared pool of configurable computing capabilities or resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

collect & operate

- A NICE Framework category consisting of specialty areas responsible for specialized denial and deception operations and collection of cybersecurity information that may be used to develop intelligence.

collection operations

- In the NICE Framework, cybersecurity work where a person: Executes collection using appropriate strategies and within the priorities established through the collection management process.

computer network defense

- The actions taken to defend against unauthorized activity within computer networks.

computer network defense analysis

- In the NICE Framework, cybersecurity work where a person: Uses defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network in order to protect information, information systems, and networks from threats.

computer network defense infrastructure support

- In the NICE Framework, cybersecurity work where a person: Tests, implements, deploys, maintains, reviews, and administers the infrastructure hardware and software that are required to effectively manage the computer network defense service provider network and resources; monitors network to actively remediate unauthorized activities.

confidentiality

- A property that information is not disclosed to users, processes, or devices unless they have been authorized to access the information.

consequence

- The effect of an event, incident, or occurrence.

continuity of operations plan

- A document that sets forth procedures for the continued performance of core capabilities and critical operations during any disruption or potential disruption.

CounterIntel (Counter Intelligence)

- monitoring other competitor organizations and nations to gather information

crimeware

- a class of malware designed specifically to automate cybercrime

critical infrastructure

- The systems and assets, whether physical or virtual, so vital to society that the incapacity or destruction of such may have a debilitating impact on the security, economy, public health or safety, environment, or any combination of these matters.

cryptanalysis

- The operations performed in defeating or circumventing cryptographic protection of information by applying mathematical techniques and without an initial knowledge of the key employed in providing the protection.

cryptocurrrency

- a digital currency in which transactions are verified and records maintained by a decentralized system using cryptography, rather than by a centralized authority.

cryptographic algorithm

- A well-defined computational procedure that takes variable inputs, including a cryptographic key, and produces an output.

cryptography

- The use of mathematical techniques to provide security services, such as confidentiality, data integrity, entity authentication, and data origin authentication.

Cryptojacking

- a type of cybercrime that involves the unauthorized use of a target's devices (computers, smartphones, tablets, or even servers) by cybercriminals to mine for cryptocurrency

cryptology

- The mathematical science that deals with cryptanalysis and cryptography.

cryptomalware

- is malware that encrypts data on the targets device and demands a ransom to restore it

Cryptominers

- Cryptomining is an online threat that hides on a computer or mobile device and uses the machine’s resources to “mine” cryptocurrencies.

customer service and technical support

- In the NICE Framework, cybersecurity work where a person: Addresses problems, installs, configures, troubleshoots, and provides maintenance and training in response to customer requirements or inquiries (e.g., tiered-level customer support).

cyber ecosystem

- The interconnected information infrastructure of interactions among persons, processes, data, and information and communications technologies, along with the environment and conditions that influence those interactions.

cyber exercise

- A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption.

cyber infrastructure

- An electronic information and communications systems and services and the information contained therein.

cyber operations

- In the NICE Framework, cybersecurity work where a person: Performs activities to gather evidence on criminal or foreign intelligence entities in order to mitigate possible or real-time threats, protect against espionage or insider threats, foreign sabotage, international terrorist activities, or to support other intelligence activities.

cyber operations planning

- in the NICE Framework, cybersecurity work where a person: Performs in-depth joint targeting and cyber planning process. Gathers information and develops detailed Operational Plans and Orders supporting requirements. Conducts strategic and operational-level planning across the full range of operations for integrated information and cyberspace operations.

cyber threat intelligence (CTI)

- The collecting, processing, organizing, and analyzing data into actionable information that relates to capabilities, opportunities, actions, and intent of adversaries in the cyber domain to meet a specific requirement determined by and informing decision-makers.

Cyberattack

- a malicious and deliberate attempt to breach the information system

cyberespionage

- or cyber spying, is a type of cyberattack in which an unauthorized user attempts to access sensitive or classified data or intellectual property (IP) for economic gain, competitive advantage or political reasons

Cybersecuring

- the process of hardening technologies, processes, and controls to protect systems, networks, programs, devices and data from cyber attacks

cybersecurity

- The activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation.

cybersecurity-aware

- knowing what security threats are and acting responsibly to avoid potential risks.

cyberthreats

- refers to anything that has the potential to cause serious harm to a computer system

cyberwarfare

- typically defined as a set of actions by a nation or organization to attack countries or institutions' computer network systems with the intention of disrupting, damaging, or destroying infrastructure by computer viruses or denial-of-service attacks

CyberWarrior

- an individual who participates in cyberwarfare, motivated either by personal, patriotic, or religious reasons, but not due to professional requirement

data administration

- In the NICE Framework, cybersecurity work where a person: Develops and administers databases and/or data management systems that allow for the storage, query, and utilization of data.

data aggregation

- The process of gathering and combining data from different sources, so that the combined data reveals new information.

data breach

- The unauthorized movement or disclosure of sensitive information to a party, usually outside the organization, that is not authorized to have or see the information.

data integrity

- The property that data is complete, intact, and trusted and has not been modified or destroyed in an unauthorized or accidental manner.

data loss

- The result of unintentionally or accidentally deleting data, forgetting where it is stored, or exposure to an unauthorized party.

data loss prevention

- A set of procedures and mechanisms to stop sensitive data from leaving a security boundary.

data mining

- The process or techniques used to analyze large sets of existing information to discover previously unrevealed patterns or correlations.

data theft

- The deliberate or intentional act of stealing of information.

DataOps

- a collaborative data management practice focused on improving the communication, integration and automation of data flows between data managers and data consumers across an organization

DBaaS (Database as a service)

- a cloud database offering that provides customers with access to a database without having to deploy and manage the underlying infrastructure

DDoS (Distributed Denial-of-Service)

- a cybercrime in which the attacker floods a target with internet traffic to prevent users from accessing connected online services and sites

de-perimeterization

- an information security strategy to strengthens an organization's security posture by implementing multiple levels of protection, including inherently secure computer systems and protocols, high-level encryption, and authentication

deauthentication

- To revoke the authentication of; to cause no longer to be authenticated.

decipher

- To convert enciphered text to plain text by means of a cryptographic system.

decode

- To convert encoded text to plain text by means of a code.

decrypt

- A generic term encompassing decode and decipher.

decryption

- The process of transforming ciphertext into its original plaintext.

Decryptor

- A tool, or set of tools, used to decrypt encrypted files. Either for recovery or anti-ransomware purposes.

deepfake

- synthetic media that have been digitally manipulated to replace one person's likeness convincingly with that of another

denial of service

- An attack that prevents or impairs the authorized use of information system resources or services.

DevOps

- the combination of cultural philosophies, practices, and tools that increases an organization's ability to deliver applications and services

DevSecOps (development, security, and operations)

- an approach to culture, automation, and platform design that integrates security as a shared responsibility throughout the entire IT lifecycle

digital forensics

- The processes and specialized techniques for gathering, retaining, and analyzing system-related data (digital evidence) for investigative purposes.

digital rights management

- A form of access control technology to protect and manage use of digital content or devices in accordance with the content or device provider's intentions.

digital signature

- A value computed with a cryptographic process using a private key and then appended to a data object, thereby digitally signing the data.

Disinformationists

- One who propagates disinformation

disruption

- An event which causes unplanned interruption in operations or functions for an unacceptable length of time.

disruptionware

- a category of malware designed to suspend operations within a target through the compromise of the availability, integrity, and confidentiality of the systems, networks, and data

distributed denial of service

- A denial of service technique that uses numerous systems to perform the attack simultaneously.

Distros

- A Linux distribution is an operating system made from a software collection that includes the Linux kernel and often a package management system.

DNSTwist

- generates a list of similarly looking domain names for a given domain name and performs DNS queries for them (A, AAAA, NS and MX) which can be used to intercept misdirected traffic.

Dorking

- using search techniques to hack into vulnerable sites or search for information that is not available in public search results

DPIA

- A Data Protection Impact Assessment (DPIA) describes a process designed to identify risks arising out of the processing of personal data and to minimize these risks as far and as early as possible

dynamic attack surface

- The automated, on-the-fly changes of an information system's characteristics to thwart actions of an adversary.

eCrime

- criminal activity that involves the use of computers or networks such as the internet

education and training

- In the NICE Framework, cybersecurity work where a person: Conducts training of personnel within pertinent subject domain; develop, plan, coordinate, deliver, and/or evaluate training courses, methods, and techniques as appropriate.

electronic signature

- Any mark in electronic form associated with an electronic document, applied with the intent to sign the document.

encipher

- To convert plaintext to ciphertext by means of a cryptographic system.

encode

- To convert plaintext to ciphertext by means of a code.

encrypt

- The generic term encompassing encipher and encode.

encryption

- The process of transforming plaintext into ciphertext.

enterprise risk management

- A comprehensive approach to risk management that engages people, processes, and systems across an organization to improve the quality of decision making for managing risks that may hinder an organization’s ability to achieve its objectives.

event

- An observable occurrence in an information system or network.

exfiltration

- The unauthorized transfer of information from an information system.

exploit

- A technique to breach the security of a network or information system in violation of security policy.

exploitation analysis

- In the NICE Framework, cybersecurity work where a person: Analyzes collected information to identify vulnerabilities and potential for exploitation.

exposure

- The condition of being unprotected, thereby allowing access to information or access to capabilities that an attacker can use to enter a system or network.

FaaS (Function as a Service)

- a cloud-computing service that allows customers to execute code in response to events, without managing the complex infrastructure

failure

- The inability of a system or component to perform its required functions within specified performance requirements.

FedRAMP-compliant (Federal Risk and Authorization Management Program)

- a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services

firewall

- A capability to limit network traffic between networks and/or information systems.

Footprinting

- an ethical hacking technique used to gather as much data as possible about a specific targeted computer system, an infrastructure and networks to identify opportunities to penetrate them

Fuzzer

- an automated software testing method that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities

Geofencing

- to set up triggers so that when a device such as an internet-connected smartphone enters a defined geographical boundary, the user gets an alert

georedundancy

- the distribution of mission-critical components or infrastructures across multiple geographic locations

hackathon

- a gathering of individuals from various backgrounds and different stages in their careers (hobbyist to professionals) to solve problems of common interest.

hacker

- An unauthorized user who attempts to or gains access to an information system.

hash value

- A numeric value resulting from applying a mathematical algorithm against a set of data such as a file.

hashing

- A process of applying a mathematical algorithm against a set of data to produce a numeric value (a 'hash value') that represents the data.

hazard

- A natural or man-made source or cause of harm or difficulty.

Honeynetting

- a network set up with intentional vulnerabilities hosted on a decoy server to attract hackers

Honeyport

- a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information

Honeypot

- a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information

Honeytokens

- is data that looks attractive to cyber criminals but is actually false or of no value

IaC (Information Assurance Component) / (Infrastructure as code)

- The process of managing and provisioning an organization’s IT infrastructure using machine-readable configuration files, rather than employing physical hardware configuration or interactive configuration tools.

ict supply chain threat

- A man-made threat achieved through exploitation of the information and communications technology (ICT) system’s supply chain, including acquisition processes.

IDaaS (identity as a Service)

- a cloud-based identity and access management (IAM) offered by a third-party provider

identity and access management

- The methods and processes used to manage subjects and their authentication and authorizations to access specific objects.

IDPS (Intrusion Detection and Prevention System)

- Software that automates the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents and attempting to stop detected possible incidents

IIoT

- the collection of sensors, instruments and autonomous devices connected through the internet to industrial applications

impersonation

- An attack type targeted phishing attack where a malicious actor pretends to be someone else or other entities to steal sensitive data

incident

- An occurrence that actually or potentially results in adverse consequences to (adverse effects on) (poses a threat to) an information system or the information that the system processes, stores, or transmits and that may require a response action to mitigate the consequences.

incident management

- The management and coordination of activities associated with an actual or potential occurrence of an event that may result in adverse consequences to information or information systems.

incident response

- The activities that address the short-term, direct effects of an incident and may also support short-term recovery.

incident response plan

- A set of predetermined and documented procedures to detect and respond to a cyber incident.

indicator

- An occurrence or sign that an incident may have occurred or may be in progress.

industrial control system

- An information system used to control industrial processes such as manufacturing, product handling, production, and distribution or to control infrastructure assets.

information and communication(s) technology

- Any information technology, equipment, or interconnected system or subsystem of equipment that processes, transmits, receives, or interchanges data or information.

information assurance

- The measures that protect and defend information and information systems by ensuring their availability, integrity, and confidentiality.

information assurance compliance

- In the NICE Framework, cybersecurity work where a person: Oversees, evaluates, and supports the documentation, validation, and accreditation processes necessary to assure that new IT systems meet the organization's information assurance and security requirements; ensures appropriate treatment of risk, compliance, and assurance from internal and external perspectives.

information security policy

- An aggregate of directives, regulations, rules, and practices that prescribe how an organization manages, protects, and distributes information.

information sharing

- An exchange of data, information, and/or knowledge to manage risks or respond to incidents.

information system resilience

- The ability of an information system to: (1) continue to operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities; and (2) recover effectively in a timely manner.

information systems security operations

- In the NICE Framework, cybersecurity work where a person: Oversees the information assurance program of an information system in or outside the network environment; may include procurement duties (e.g., Information Systems Security Office

information technology

- Any equipment or interconnected system or subsystem of equipment that processes, transmits, receives, or interchanges data or information.

InfoSec (Information Security)

- the processes and tools designed and deployed to protect sensitive business information from modification, disruption, destruction, and inspection

inside( r) threat

- A person or group of persons within an organization who pose a potential risk through violating security policies.

integrated risk management

- The structured approach that enables an enterprise or organization to share risk information and risk analysis and to synchronize independent yet complementary risk management strategies to unify efforts across the enterprise.

integrity

- The property whereby information, an information system, or a component of a system has not been modified or destroyed in an unauthorized manner.

intent

- A state of mind or desire to achieve an objective.

interoperability

- The ability of two or more systems or components to exchange information and to use the information that has been exchanged.

intrusion

- An unauthorized act of bypassing the security mechanisms of a network or information system.

intrusion detection

- The process and methods for analyzing information from networks and information systems to determine if a security breach or security violation has occurred.

investigate

- a NICE Framework category consisting of specialty areas responsible for the investigation of cyber events and/or crimes of IT systems, networks, and digital evidence

investigation

- A systematic and formal inquiry into a qualified threat or incident using digital forensics and perhaps other traditional criminal inquiry techniques to determine the events that transpired and to collect evidence.

IoA (Indicators of Attack)

- a clue that a malicious entity has gained, or is attempting to gain, unauthorized access to the network or assets connected to the network

IoC (Indicators of Compromise)

- clues and evidence of a data breach

IPSec (Internet Protocol Security)

- a set of communication rules or protocols for setting up secure connections over a network

keylogger

- a tool that record what a person types on a device

Keystores

- Repositories that contain cryptographic artifacts like certificates and private keys that are used for cryptographic protocols such as TLS

knowledge management

- In the NICE Framework, cybersecurity work where a person: Manages and administers processes and tools that enable the organization to identify, document, and access intellectual capital and information content.

LaaS (Logging as a service)

- an IT architectural model for centrally ingesting and collecting any type of log files coming from any given source or location such as servers, applications, and devices

LangSec (Language Security)

- a design and programming philosophy that focuses on formally correct and verifiable input handling throughout all phases of the software development lifecycle

legal advice and advocacy

- In the NICE Framework, cybersecurity work where a person: Provides legally sound advice and recommendations to leadership and staff on a variety of relevant topics within the pertinent subject domain; advocates legal and policy changes and makes a case on behalf of client via a wide range of written and oral work products, including legal briefs and proceedings.

machine learning and evolution

- A field concerned with designing and developing artificial intelligence algorithms for automated knowledge discovery and innovation by information systems.

macro virus

- A type of malicious code that attaches itself to documents and uses the macro programming capabilities of the document’s application to execute, replicate, and spread or propagate itself.

malicious applet

- A small application program that is automatically downloaded and executed and that performs an unauthorized function on an information system.

malicious code

- Program code intended to perform an unauthorized function or process that will have adverse impact on the confidentiality, integrity, or availability of an information system.

malicious logic

- Hardware, firmware, or software that is intentionally included or inserted in a system to perform an unauthorized function or process that will have adverse impact on the confidentiality, integrity, or availability of an information system.

Malvertising

- a malicious attack that involves injecting harmful code into legitimate online advertising networks

malware

- Software that compromises the operation of a system by performing an unauthorized function or process.

Metaverse

- A shared, immersive, persistent, 3D virtual space where humans experience life in ways they could not in the physical world

mitigation

- The application of one or more measures to reduce the likelihood of an unwanted occurrence and/or lessen its consequences.

MitM (Man in the Middle)

- a man-in-the-middle attack is a cyberattack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating

moving target defense

- The presentation of a dynamic attack surface, increasing an adversary's work factor necessary to probe, attack, or maintain presence in a cyber target.

network resilience

- The ability of a network to: (1) provide continuous operation (i.e., highly resistant to disruption and able to operate in a degraded mode if damaged); (2) recover effectively if failure does occur; and (3) scale to meet rapid or unpredictable demands.

network services

- In the NICE Framework, cybersecurity work where a person: Installs, configures, tests, operates, maintains, and manages networks and their firewalls, including hardware (e.g., hubs, bridges, switches, multiplexers, routers, cables, proxy servers, and protective distributor systems) and software that permit the sharing and transmission of all spectrum transmissions of information to support the security of information and information systems.

non-repudiation

- A property achieved through cryptographic methods to protect against an individual or entity falsely denying having performed a particular action related to data.

OAuth (Open Authorization standard)

- an open-standard authorization protocol or framework that provides applications the ability for secure designated access

object

- A passive information system-related entity containing or receiving information.

OffSec (Offensive Security)

- the proactive approach to securing networks and systems from attacks by actively seeking out vulnerabilities and weaknesses

OpenIOC (Open Indicators of Compromise)

- an extensible XML schema that enables you to describe the technical characteristics that identify a known threat, an attacker's methodology, or other evidence of compromise

operate & maintain

- A NICE Framework category consisting of specialty areas responsible for providing the support, administration, and maintenance necessary to ensure effective and efficient IT system performance and security.

operational exercise

- An action-based exercise where personnel rehearse reactions to an incident scenario, drawing on their understanding of plans and procedures, roles, and responsibilities.

operations technology

- The hardware and software systems used to operate industrial control devices.

outside( r) threat

- A person or group of persons external to an organization who are not authorized to access its assets and pose a potential risk to the organization and its assets.

Overfitting

- an undesirable machine learning behavior that occurs when the machine learning model gives accurate predictions for training data but not for new data

oversight & development

- A NICE Framework category consisting of specialty areas providing leadership, management, direction, and/or development and advocacy so that all individuals and the organization may effectively conduct cybersecurity work.

PaaS (Platform as a Service)

- a cloud computing model where a third-party provider delivers hardware and software tools to users over the internet

passive attack

- An actual assault perpetrated by an intentional threat source that attempts to learn or make use of information from a system, but does not attempt to alter the system, its resources, its data, or its operations.

password

- A string of characters (letters, numbers, and other symbols) used to authenticate an identity or to verify access authorization.

passwordless

- an authentication method in which a user can log in to a computer system without the entering a password or any other knowledge-based secret

pen test

- A colloquial term for penetration test or penetration testing.

penetration testing

- An evaluation methodology whereby assessors search for vulnerabilities and attempt to circumvent the security features of a network and/or information system.

Pentester (Penetration tester)

- An information security expert who performs penetration tests

personal identifying information / personally identifiable information

- The information that permits the identity of an individual to be directly or indirectly inferred.

phishing

- A digital form of social engineering to deceive individuals into providing sensitive information.

PIV

- an identification card issued by a federal agency that contains a computer chip, which allows it to receive, store, recall, and send information in a secure method

plaintext

- Unencrypted information.

precursor

- An observable occurrence or sign that an attacker may be preparing to cause an incident.

preparedness

- The activities to build, sustain, and improve readiness capabilities to prevent, protect against, respond to, and recover from natural or manmade incidents.

privacy

- The assurance that the confidentiality of, and access to, certain information about an entity is protected.

private key

- A cryptographic key that must be kept confidential and is used to enable the operation of an asymmetric (public key) cryptographic algorithm.

protect & defend

- A NICE Framework category consisting of specialty areas responsible for the identification, analysis, and mitigation of threats to internal IT systems or networks.

Proxyjacking

- a malicious technique where an attacker gains control over a target's proxy server, allowing them to intercept and manipulate the targets internet traffic

PTaaS

- a hybrid solution that combines the breadth of automation with the depth of human assessment, while integrated with advanced vulnerability management and analytics

public key

- A cryptographic key that may be widely published and is used to enable the operation of an asymmetric (public key) cryptographic algorithm.

public key cryptography

- A branch of cryptography in which a cryptographic system or algorithms use two uniquely linked keys: a public key and a private key (a key pair).

public key infrastructure

- A framework consisting of standards and services to enable secure, encrypted communication and authentication over potentially insecure networks such as the Internet.

ransomware

- a malware designed to deny a user or organization access to files on their computer

recovery

- The activities after an incident or event to restore essential services and operations in the short and medium term and fully restore all capabilities in the longer term.

red team

- A group authorized and organized to emulate a potential adversary’s attack or exploitation capabilities against an enterprise’s cybersecurity posture.

red team exercise

- An exercise, reflecting real-world conditions, that is conducted as a simulated attempt by an adversary to attack or exploit vulnerabilities in an enterprise's information systems.

redundancy

- Additional or alternative systems, sub-systems, assets, or processes that maintain a degree of overall functionality in case of loss or failure of another system, sub-system, asset, or process.

Remoting

- A technology that allows a program to interact with the internals of another program running on a different machine

Repojacking

- intentionally taking over the account of an owner or maintainer who hosts a repository

resilience

- The ability to adapt to changing conditions and prepare for, withstand, and rapidly recover from disruption.

response

- The activities that address the short-term, direct effects of an incident and may also support short-term recovery.

risk

- The potential for an unwanted or adverse outcome resulting from an incident, event, or occurrence, as determined by the likelihood that a particular threat will exploit a particular vulnerability, with the associated consequences.

risk analysis

- The systematic examination of the components and characteristics of risk.

risk assessment

- The product or process which collects information and assigns values to risks for the purpose of informing priorities, developing or comparing courses of action, and informing decision making.

risk management

- The process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring or controlling it to an acceptable level considering associated costs and benefits of any actions taken.

risk-based data management

- A structured approach to managing risks to data and information by which an organization selects and applies appropriate security controls in compliance with policy and commensurate with the sensitivity and value of the data.

rootkit

- A set of software tools with administrator-level access privileges installed on an information system and designed to hide the presence of the tools, maintain the access privileges, and conceal the activities conducted by the tools.

RTOS

- A real-time operating system (RTOS) is an OS that guarantees real-time applications a certain capability within a specified deadline.

Scareware

- a cyberattack tactic that frightens people into visiting spoofed or infected websites or downloading malicious software (malware)

SECaaS (Security as a Service)

- a cloud-based method of outsourcing your cybersecurity

SecDevOps

- a software development methodology that places security concerns first in planning and development

SecOps

- a combination of the terms security and operations, is a methodology that IT managers implement to enhance the connection, collaboration and communication between IT security and IT operations teams

secret key

- A cryptographic key that is used for both encryption and decryption, enabling the operation of a symmetric key cryptography scheme.

securely provision

- A NICE Framework category consisting of specialty areas concerned with conceptualizing, designing, and building secure IT systems, with responsibility for some aspect of the systems' development.

security automation

- The use of information technology in place of manual processes for cyber incident response and management.

security policy

- A rule or set of rules that govern the acceptable use of an organization's information and services to a level of acceptable risk and the means for protecting the organization's information assets.

security program management

- In the NICE Framework, cybersecurity work where a person: Manages information security (e.g., information security) implications within the organization, specific program, or other area of responsibility, to include strategic, personnel, infrastructure, policy enforcement, emergency planning, security awareness, and other resources (e.g., the role of a Chief Information Security Officer).

SIEM (Security information and event management)

- a security solution that helps organizations detect threats before they disrupt business

signature

- A recognizable, distinguishing pattern.

situational awareness

- Comprehending information about the current and developing security posture and risks, based on information gathered, observation and analysis, and knowledge or experience.

SlowLoris

- an attack tool designed to take down a server by flooding it with incomplete HTTP requests, without using much of bandwidth

smishing

- the fraudulent practice of sending text messages purporting to be from reputable companies in order to induce individuals to reveal personal information

SoC (Security Operations Center)

- an intelligence hub for the company, gathering data from across the organization's networks, servers, endpoints and other digital assets and using intelligent automation to identify, prioritize and respond to potential cybersecurity threats

Social Engineering

- the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes

software assurance

- The level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its lifecycle, and that the software functions in the intended manner.

software assurance and security engineering

- In the NICE Framework, cybersecurity work where a person: Develops and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs following software assurance best practices.

spam

- The abuse of electronic messaging systems to indiscriminately send unsolicited bulk messages.

Spidering

- the process where hackers familiarize themselves with their targets in order to obtain credentials based on their activity

spoofing

- Faking the sending address of a transmission to gain illegal [unauthorized] entry into a secure system.

spyware

- Software that is secretly or surreptitiously installed into an information system without the knowledge of the system user or owner.

STaaS (Storage as a Service)

- a practice of using public cloud storage resources to store your data

strategic planning and policy development

- In the NICE Framework, cybersecurity work where a person: Applies knowledge of priorities to define an entity.

subject

- An individual, process, or device causing information to flow among objects or a change to the system state.

supervisory control and data acquisition

- A generic name for a computerized system that is capable of gathering and processing data and applying operational controls to geographically dispersed assets over long distances.

supply chain

- A system of organizations, people, activities, information and resources, for creating and moving products including product components and/or services from suppliers through to their customers.

supply chain risk management

- The process of identifying, analyzing, and assessing supply chain risk and accepting, avoiding, transferring or controlling it to an acceptable level considering associated costs and benefits of any actions taken.

switchport

- the physical opening where a data cable can be plugged in

symmetric cryptography

- A branch of cryptography in which a cryptographic system or algorithms use the same secret key (a shared secret key).

symmetric key

- A cryptographic key that is used to perform both the cryptographic operation and its inverse, for example to encrypt plaintext and decrypt ciphertext, or create a message authentication code and to verify the code.

SysOp (System Operator)

- responsible for the upkeep and maintenance of servers, networks, and other IT infrastructure

system administration

- In the NICE Framework, cybersecurity work where a person: Installs, configures, troubleshoots, and maintains server configurations (hardware and software) to ensure their confidentiality, integrity, and availability; also manages accounts, firewalls, and patches; responsible for access control, passwords, and account creation and administration.

system integrity

- The attribute of an information system when it performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.

systems development

- In the NICE Framework, cybersecurity work where a person: Works on the development phases of the systems development lifecycle.

systems requirements planning

- In the NICE Framework, cybersecurity work where a person: Consults with customers to gather and evaluate functional requirements and translates these requirements into technical solutions; provides guidance to customers about applicability of information systems to meet business needs.

systems security analysis

- In the NICE Framework, cybersecurity work where a person: Conducts the integration/testing, operations, and maintenance of systems security.

systems security architecture

- In the NICE Framework, cybersecurity work where a person: Develops system concepts and works on the capabilities phases of the systems development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into system and security designs and processes.

tabletop exercise

- A discussion-based exercise where personnel meet in a classroom setting or breakout groups and are presented with a scenario to validate the content of plans, procedures, policies, cooperative agreements or other information for managing an incident.

tailored trustworthy space

- A cyberspace environment that provides a user with confidence in its security, using automated mechanisms to ascertain security conditions and adjust the level of security based on the user's context and in the face of an evolving range of threats.

targets

- In the NICE Framework, cybersecurity work where a person: Applies current knowledge of one or more regions, countries, non-state entities, and/or technologies.

technology research and development

- In the NICE Framework, cybersecurity work where a person: Conducts technology assessment and integration processes; provides and supports a prototype capability and/or evaluates its utility.

test and evaluation

- In the NICE Framework, cybersecurity work where a person: Develops and conducts tests of systems to evaluate compliance with specifications and requirements by applying principles and methods for cost-effective planning, evaluating, verifying, and validating of technical, functional, and performance characteristics (including interoperability) of systems or elements of systems incorporating information technology.

threat

- A circumstance or event that has or indicates the potential to exploit vulnerabilities and to adversely impact (create adverse consequences for) organizational operations, organizational assets (including information and information systems), individuals, other organizations, or society.

threat agent

- An individual, group, organization, or government that conducts or has the intent to conduct detrimental activities.

threat analysis

- The detailed evaluation of the characteristics of individual threats.

threat assessment

- The product or process of identifying or evaluating entities, actions, or occurrences, whether natural or man-made, that have or indicate the potential to harm life, information, operations, and/or property.

threatscape

- the spectrum of possible cybersecurity threats

Threatware

- a general term encompassing all types of malicious software on computers and electronic devices

ticket

- In access control, data that authenticates the identity of a client or a service and, together with a temporary encryption key (a session key), forms a credential.

Timestomping

- a technique used in cybersecurity and digital forensics, where attackers modify the timestamps of files and directories on a computer system to hide their actions or impede investigations

traffic light protocol

- A set of designations employing four colors (RED, AMBER, GREEN, and WHITE) used to ensure that sensitive information is shared with the correct audience.

Trojan

- a type of malware that conceals its true content to fool a user into thinking it's a harmless file

trojan horse

- A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the program.

Trojanize

- To convert into a Trojan

Typosquatting

- a form of cybersquatting (sitting on sites under someone else's brand or copyright) that targets Internet users who incorrectly type a website address into their web browser

unauthorized access

- Any access that violates the stated security policy.

Virtualization

- creating virtual representations of servers, storage, networks, and other physical machines

virus

- A computer program that can replicate itself, infect a computer without permission or knowledge of the user, and then spread or propagate to another computer.

vishing

- a hacking technique of defrauding targets over the phone, enticing them to divulge sensitive information

vulnerability

- A characteristic or specific weakness that renders an organization or asset (such as information or an information system) open to exploitation by a given threat or susceptible to a given hazard.

vulnerability assessment and management

- In the NICE Framework, cybersecurity work where a person: Conducts assessments of threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations.

wardriving

- attackers searching for wireless networks with vulnerabilities while moving around an area in a moving vehicle

Wargaming

- an interactive technique that immerses potential cyber incident responders in a simulated cyber scenario

weakness

- A shortcoming or imperfection in software code, design, architecture, or deployment that, under proper conditions, could become a vulnerability or contribute to the introduction of vulnerabilities.

Weaponization

- an attacker creates malware or malicious payloads to use against the target by designing new forms of malware. Modifying existing programs to better match the vulnerabilities they're trying to exploit

Weaponize

- to develop an exploit against a vulnerability into an attack tool that can be deployed against a target

white team

- A group responsible for refereeing an engagement between a Red Team of mock attackers and a Blue Team of actual defenders of information systems.

whitebox

- a form of testing that is performed with knowledge of a target system's internals

work factor

- An estimate of the effort or time needed by a potential adversary, with specified expertise and resources, to overcome a protective measure.

worm

- A self-replicating, self-propagating, self-contained program that uses networking mechanisms to spread itself.

XaaS (Anything as a service)

- a general category of services related to cloud computing and remote access