Introducing our comprehensive cybersecurity dictionary, your go-to resource for understanding essential terms in the ever-evolving world of cybersecurity. Packed with concise definitions and explanations, this carefully curated dictionary covers a wide range of cybersecurity concepts, from threat intelligence to penetration testing.
Whether you’re a beginner or an experienced professional, our dictionary provides valuable insights to enhance your understanding of cybersecurity terminology.
Cybersecurity Dictionary
Access control
The process of granting or denying authorized users access to resources based on specific rules and policies.
Actionable Threat Intelligence
Actionable Threat Intelligence refers to the intelligence gathered from various sources that provides specific and practical guidance on how to detect, prevent, or respond to potential threats. It offers organizations the necessary information to take proactive measures and make informed decisions.
Active Defense
The use of offensive cyber capabilities to disrupt or counter cyber attacks, including techniques such as hacking back or retaliatory actions.
Advanced Encryption Standard (AES)
A widely used symmetric encryption algorithm known for its robustness and efficiency.
Advanced Persistent Threat (APT)
A targeted and sophisticated cyber attack that remains undetected for extended periods, often conducted by skilled adversaries.
Adware
Software that displays unwanted advertisements on a user's computer or device.
Agile Security
An iterative and flexible approach to cybersecurity that adapts to changing threats and business needs.
AI in cybersecurity
The use of artificial intelligence and machine learning techniques to enhance security measures and threat detection.
Anonymization
Techniques used to protect privacy by removing or obfuscating personally identifiable information from data sets.
Antivirus
Software designed to detect, prevent, and remove malicious software, such as viruses, worms, and Trojans, from computer systems.
Application Programming Interface (API)
A set of protocols and tools that allow different software applications to communicate and interact with each other.
Application Security
Protective measures implemented to secure software applications from unauthorized access, vulnerabilities, and attacks.
Application Security Testing
The assessment of software applications for security vulnerabilities and weaknesses, including source code analysis, fuzzing, or dynamic testing.
APT (Advanced Persistent Threat)
A targeted and sophisticated cyber attack that remains undetected for extended periods, often conducted by skilled adversaries.
Asset Management
The process of identifying, tracking, and managing an organization's assets to ensure their security and optimal use.
Audit
A systematic examination and evaluation of an organization's security controls, policies, and procedures to ensure compliance and identify vulnerabilities.
Authentication
The process of verifying the identity of a user, device, or system entity to ensure authorized access.
Authorization
The process of granting or denying access rights to resources based on established policies and user privileges.
Availability
The quality or state of being accessible and usable by authorized users when needed, without disruption or downtime.
Backdoor
A hidden entry point in a system that bypasses normal authentication or security mechanisms, allowing unauthorized access.
Behavior-Based Detection
A security technique that analyzes user behavior and system activity to identify abnormal patterns indicating potential threats.
Behavioral Analytics
The use of algorithms and machine learning techniques to detect patterns and anomalies in user behavior, helping identify potential threats.
Big Data Security
Security measures and strategies applied to protect large volumes of data, often characterized by high velocity, variety, and complexity.
Biometrics
Authentication methods based on unique physical or behavioral characteristics, such as fingerprints, iris patterns, or voice recognition.
Black Box Testing
A type of penetration testing where the tester has no prior knowledge of the system, simulating an attacker with limited information.
Black Hat
A term used to describe a hacker or cybercriminal who uses their skills for malicious purposes or personal gain.
Blacklisting
The practice of blocking or denying access to known malicious entities, such as IP addresses, domains, or software signatures.
Bot
A software application that performs automated tasks on the internet, often used for malicious activities like spamming or spreading malware.
Botnet
A network of compromised computers controlled by a central attacker, used for malicious activities like DDoS attacks or spreading malware.
Brute Force Attack
A technique used by attackers to systematically guess passwords or encryption keys by trying all possible combinations.
Business Continuity Planning
Process of developing strategies and procedures to ensure the continued operation of critical business functions during and after a disaster or disruptive event.
Business Email Compromise (BEC)
A type of scam where attackers impersonate a trusted contact to trick individuals or organizations into fraudulent transactions or divulging sensitive information.
Business Impact Analysis (BIA)
The process of assessing the potential impact of a disruption on critical business functions and defining recovery objectives.
C4ISR (Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance)
The integrated system of technology and processes used for military command, control, and intelligence operations.
Ciphertext
The encrypted form of data that has been transformed using an encryption algorithm and is unreadable without the corresponding decryption key.
CISO (Chief Information Security Officer)
A senior executive responsible for managing an organization's information security strategy and programs.
Cloud Security
Security measures and practices designed to protect data, applications, and infrastructure in cloud computing environments.
Code Review
A systematic examination of software source code to identify security vulnerabilities, coding errors, and adherence to best practices.
Command and Control (C2)
The infrastructure and communication channels used by attackers to control compromised systems or malware.
Command Injection
A type of attack where an attacker executes unauthorized commands through a vulnerable command execution interface.
Compromise
The successful breach or unauthorized access to a system, network, or data by an attacker.
Computer Emergency Response Team (CERT)
An organization responsible for coordinating responses to cybersecurity incidents and providing support to affected entities.
Container Security
The protection of containerized applications and the underlying infrastructure against threats and vulnerabilities.
Countermeasure
A proactive measure or action taken to prevent or mitigate security risks or attacks.
Critical Infrastructure Protection
Measures and practices to safeguard vital systems and assets, such as power grids, transportation, and communication networks, from cyber threats.
Cross-Site Scripting (XSS)
A type of web vulnerability that allows attackers to inject malicious scripts into web pages viewed by users.
Cryptanalysis
The study and analysis of cryptographic algorithms and systems to uncover weaknesses or vulnerabilities.
Cryptocurrency
A digital or virtual form of currency that uses cryptography for secure financial transactions, control the creation of additional units, and verify the transfer of assets.
Cryptography
The practice and study of secure communication techniques to protect information from unauthorized access or disclosure.
CTI (Cyber Threat Intelligence)
The collection, analysis, and dissemination of information about potential or current cyber threats to inform defensive strategies and mitigate risks.
Cyber Arms Race
The ongoing competition among nations and threat actors to develop and deploy advanced cyber capabilities, leading to an escalation of cyber warfare capabilities and techniques.
Cyber Attack
An intentional action aimed at exploiting computer systems, networks, or devices to compromise data, disrupt operations, or cause harm.
Cyber Attack Attribution
The process of identifying and attributing a cyber attack to a specific individual, group, or nation-state based on technical indicators and intelligence.
Cyber Command
A military unit or organization responsible for conducting cyber operations and defending against cyber threats in a nation's defense strategy.
Cyber Deterrence
The use of defensive and offensive capabilities to deter potential adversaries from launching cyber attacks by increasing the perceived risks and consequences.
Cyber Espionage
The covert gathering of sensitive or classified information through cyber means, often conducted by nation-states or advanced threat actors.
Cyber Exercises
Simulated scenarios and drills conducted by military or government organizations to test and evaluate their cyber capabilities, response plans, and coordination.
Cyber Insurance
Insurance coverage that provides financial protection against losses or damages resulting from cyber attacks or data breaches.
Cyber Intelligence
The collection, analysis, and interpretation of intelligence related to cyber threats, capabilities, and activities of potential adversaries.
Cyber Intelligence Sharing
The collaborative exchange of cyber threat intelligence between military or government organizations to enhance situational awareness and response capabilities.
Cyber Range
A controlled and isolated environment used for training, testing, and simulating cybersecurity scenarios and incident response.
Cyber Resilience
The ability of a military or government organization to withstand and recover from cyber attacks, ensuring continuity of operations and mission readiness.
Cyber Threat Intelligence
Information about potential or current cyber threats, including threat actors, their methods, and indicators of compromise.
Cyber Threat Landscape
The overall view of existing and emerging cyber threats, including trends, patterns, and the evolving tactics of threat actors.
Cyber Warfare Doctrine
A set of principles, strategies, and rules that govern the conduct of cyber warfare and guide the decision-making process.
Cyber Weapons
Malicious software or tools specifically designed to be used as offensive capabilities in cyber warfare or cyber espionage operations.
Cybersecurity
The practice of protecting computer systems, networks, and data from digital attacks, theft, and damage.
Cybersecurity Incident Response Team (CSIRT)
A specialized team responsible for coordinating and responding to cyber incidents within a military or government organization.
Cybersecurity Operations Center (CSOC)
A centralized unit within a military or government organization responsible for monitoring, detecting, and responding to cyber threats.
Cybersecurity Policy
Government-issued directives, regulations, and guidelines that outline the objectives, principles, and requirements for ensuring cybersecurity within a nation's defense strategy.
Cyberwarfare
The use of technology and cyberspace for offensive and defensive operations with the aim of achieving strategic military or political objectives.
Cyberwarfare Strategy
A comprehensive plan that outlines the objectives, doctrines, and tactics to be employed in cyber warfare, aligned with national security and defense goals.
Dark Web Monitoring
The monitoring and analysis of dark web forums, marketplaces, and other hidden online communities to identify potential cyber threats or illegal activities.
Darknet
A part of the internet that is intentionally hidden and accessible only through specialized tools, often associated with illegal activities.
Data breach
The unauthorized access, disclosure, or acquisition of sensitive or protected data.
Data Classification
The process of categorizing data based on its sensitivity, value, and regulatory requirements to apply appropriate security controls.
Data Governance
The establishment and enforcement of policies, processes, and controls to ensure the confidentiality, integrity, and availability of data.
Data Leakage
The unintentional or unauthorized transmission or exposure of sensitive data to unintended recipients or unauthorized parties.
Data Loss Prevention (DLP)
Technologies and processes used to prevent the accidental or intentional loss or leakage of sensitive data.
Data Privacy
The protection of personal information and ensuring that individuals have control over how their data is collected, used, and shared.
Data Recovery
The process of restoring lost, damaged, or inaccessible data from storage media or backup systems.
Data Security
The protection of data from unauthorized access, use, disclosure, disruption, modification, or destruction, ensuring its confidentiality, integrity, and availability.
Decryption
The process of converting encrypted data back to its original plaintext form using a decryption key.
Deep Packet Inspection (DPI)
A network analysis technique that examines the contents of network packets, allowing for detailed inspection and filtering based on protocols, applications, or content.
Deepfake
A manipulated or synthesized audio, video, or image that appears authentic but is actually artificially created or modified.
Denial of Service (DoS)
An attack that aims to disrupt or make a computer or network unavailable to its intended users by overwhelming it with a flood of illegitimate requests.
Digital Certificate
An electronic document that binds cryptographic keys to the identity of an entity, used for authentication and secure communication.
Digital Footprint
The trail of information left by individuals or organizations as a result of their online activities.
Digital Forensics
The process of collecting, analyzing, and preserving electronic evidence in order to investigate and prevent cybercrimes.
Digital Identity
The unique representation of an individual, organization, or device in a digital context, often used for authentication and access control.
Distributed Denial of Service (DDoS)
An attack that overwhelms a network or website with a flood of illegitimate traffic, causing it to become unavailable to legitimate users.
DNS Security
Measures and protocols implemented to protect the Domain Name System (DNS) from attacks and abuse.
Eavesdropping
The unauthorized interception and monitoring of communication, such as capturing network traffic or listening to phone conversations.
Encryption
The process of converting plaintext into a secret code to protect data confidentiality and integrity.
Encryption Key
A piece of information used to encrypt or decrypt data, ensuring its confidentiality and integrity.
Endpoint Detection and Response (EDR)
A security solution that monitors and investigates endpoint activities to detect and respond to threats.
Endpoint Security
The protection of individual devices, such as computers, smartphones, or IoT devices, from security threats and unauthorized access.
Ethical Hacker
A security professional who legally and ethically identifies vulnerabilities in computer systems, networks, or applications to help improve security.
Exploit
A piece of software or code that takes advantage of a vulnerability in a system or application to carry out unauthorized actions.
Exploit Framework
A collection of tools, scripts, and exploits used to automate and streamline the process of identifying and exploiting vulnerabilities in systems or applications.
Exploit Kit
A toolkit containing pre-built software and tools used by attackers to exploit vulnerabilities in systems or applications.
File Integrity Monitoring (FIM)
The process of monitoring and detecting unauthorized changes or modifications to files and system configurations.
Firewall
A network security device that monitors and filters incoming and outgoing network traffic based on predetermined security rules.
Forensics
The application of scientific methods and techniques to investigate and analyze digital evidence for legal purposes.
Fuzzing
A testing technique that involves sending malformed or unexpected inputs to software or systems to uncover vulnerabilities or crashes.
Gamification in Security
The use of game elements and mechanics to engage and motivate users in security awareness training and activities.
GDPR (General Data Protection Regulation)
A European Union regulation that governs the protection and privacy of personal data and imposes obligations on organizations handling such data.
Gray Box Testing
A hybrid approach to penetration testing where the tester has partial knowledge of the system, combining elements of white box and black box testing.
Hacker
An individual with advanced technical skills who explores vulnerabilities in computer systems or networks, sometimes for malicious purposes.
Honeypot
A decoy system or network designed to attract and deceive attackers, allowing for the monitoring and analysis of their activities.
Incident Management
The coordinated process of identifying, responding to, and managing cybersecurity incidents to minimize their impact and restore normal operations.
Incident Response
The systematic approach of detecting, investigating, and responding to cybersecurity incidents to minimize their impact.
Indicators of Attack (IOAs)
Observable patterns or activities that suggest an ongoing or imminent cyber attack, helping to identify and respond to threats in real-time.
Information Security
The protection of information from unauthorized access, use, disclosure, disruption, modification, or destruction, ensuring its confidentiality, integrity, and availability.
Information Warfare
The use of information and communication technologies to influence, manipulate, or disrupt the perception, cognition, or behavior of adversaries.
Insider Threat
A security risk posed by individuals within an organization who have authorized access but misuse their privileges or act against the organization's interests.
Insider Threat Detection
Technologies and practices used to identify and mitigate risks posed by insiders with authorized access to sensitive information.
Integrity
The assurance that data or systems remain complete, unaltered, and free from unauthorized modifications or tampering.
Internet of Things (IoT)
The network of interconnected physical devices embedded with sensors, software, and connectivity that enables them to exchange data.
Internet Security
The protection of internet-connected systems, networks, and services from security threats and unauthorized access.
Intrusion Detection System (IDS)
A security tool that monitors network traffic and system events to identify and respond to suspicious or malicious activity.
Intrusion Prevention System (IPS)
A security control that monitors network traffic and actively blocks or prevents identified threats or malicious activity.
IOC (Indicators of Compromise)
Artifacts or evidence that indicates a system has been compromised or is under attack, helping to identify and respond to threats.
Key Management
The processes and procedures involved in generating, storing, distributing, and revoking cryptographic keys.
Keylogger
A type of malicious software or hardware that records keystrokes on a computer or device to capture sensitive information, such as passwords or credit card details.
Logical Access Control
The use of authentication, authorization, and accounting mechanisms to control and manage access to digital resources.
Machine Learning in Cybersecurity
The application of machine learning algorithms and techniques to improve threat detection, anomaly detection, and security analytics.
Malicious Code
Software or scripts intentionally designed to cause harm, including viruses, worms, Trojans, ransomware, and spyware.
Malicious Insider
An authorized individual within an organization who intentionally engages in malicious activities or abuses their privileges.
Malware
Malicious software that is designed to damage or gain unauthorized access to computer systems or networks.
Managed Detection and Response (MDR)
A comprehensive security service that combines 24/7 threat monitoring, incident response, and threat hunting capabilities.
Managed Security Service Provider (MSSP)
A company that provides outsourced management and monitoring of security systems and devices for organizations.
Mobile Application Security
The protection of mobile applications from vulnerabilities, malicious code, data leakage, and unauthorized access.
Mobile Device Management (MDM)
A set of technologies and practices used to secure and manage mobile devices, such as smartphones and tablets, in an enterprise environment.
Multi-Factor Authentication (MFA)
A security measure that requires users to provide multiple forms of identification, typically a combination of passwords, tokens, or biometrics.
Nation-State Actor
A nation-state or government-sponsored entity that conducts cyber operations, including espionage, sabotage, or offensive cyber attacks.
Network Penetration Testing
The process of assessing the security of a network infrastructure to identify vulnerabilities that could be exploited by attackers.
Network Security
The measures and practices implemented to protect computer networks and their infrastructure from unauthorized access, misuse, or disruption.
Network Segmentation
The division of a network into smaller subnetworks to isolate and protect critical assets and reduce the impact of security breaches.
Open Source
Software or hardware that is freely available and allows users to view, modify, and distribute the source code or design.
Open Source Intelligence (OSINT)
Information collected from publicly available sources, such as websites, social media, or news articles, to identify potential threats or vulnerabilities.
Open Web Application Security Project (OWASP)
A non-profit organization that provides resources, tools, and best practices for web application security.
OWASP (Open Web Application Security Project)
A non-profit organization that provides resources, tools, and best practices for web application security, including a list of the top 10 most critical web application security risks.
Password
A secret authentication credential used to verify the identity of a user and grant access to a system or application.
Password Cracking
The process of recovering passwords from stored hashes or encrypted formats to assess the strength of password policies and identify weak passwords.
Password Policy
A set of rules and requirements governing the creation, use, and management of passwords within an organization.
Patch Management
The process of acquiring, testing, and applying software patches and updates to address known vulnerabilities and security flaws.
Payload
The malicious or harmful part of a cyber attack, such as a virus, Trojan, or ransomware, delivered to a target system.
Penetration Testing
The authorized attempt to evaluate the security of a system or network by simulating real-world attacks to identify vulnerabilities.
Perimeter Security
The protection of network boundaries and entry points to prevent unauthorized access and external threats.
Pharming
A cyber attack that redirects website traffic to a fraudulent site, often through DNS cache poisoning or manipulation.
Phishing
A cyber attack that uses deceptive techniques, such as fraudulent emails or websites, to trick individuals into revealing sensitive information.
Physical Penetration Testing
The assessment of physical security controls, such as buildings, facilities, or data centers, to identify weaknesses that could be exploited by attackers.
Pivoting
The technique of using a compromised system or network as a stepping stone to gain access to other systems or networks within the target environment.
Port Scanning
The process of scanning a target system or network to identify open ports, services, and potential entry points for further attacks.
Post-Exploitation
The stage of a penetration test where the tester maintains access to a compromised system or network to gather intelligence or perform further attacks.
Privacy by Design
An approach to system design that prioritizes privacy and embeds privacy features and safeguards into the architecture and operations.
Privacy Policy
A statement or document that outlines an organization's practices and procedures regarding the collection, use, and protection of personal information.
Privilege Escalation
The act of gaining elevated privileges or access rights beyond what is normally authorized or intended.
Protocol
A set of rules or standards that govern the exchange of data between systems, devices, or applications.
Ransomware
Malicious software that encrypts files or systems and demands a ransom payment in exchange for restoring access.
Ransomware-as-a-Service (RaaS)
A model where cybercriminals rent or sell ransomware to other attackers, enabling them to carry out attacks without technical expertise.
Real-time Monitoring
Continuous and immediate monitoring and analysis of events or activities in order to detect and respond to threats promptly.
Reconnaissance
The initial phase of an attack where attackers gather information about a target system or organization to identify vulnerabilities.
Red Team
A group of ethical hackers who simulate real-world attacks on an organization's systems to identify vulnerabilities and improve security.
Reverse Engineering
The process of analyzing and understanding the inner workings of a software application or system to uncover vulnerabilities, often used in penetration testing to assess proprietary software or protocols.
Risk Assessment
The process of identifying, analyzing, and evaluating potential risks to an organization's information assets and determining appropriate mitigation strategies.
Security Audit
A comprehensive review and assessment of an organization's security controls, policies, and procedures to ensure compliance and identify vulnerabilities.
Security Awareness
The knowledge and understanding of potential security risks and best practices for protecting sensitive information and computer systems.
Security Incident
An adverse event or activity that poses a threat to the confidentiality, integrity, or availability of information or systems.
Security Incident Response Plan (SIRP)
A documented framework and set of procedures to guide organizations in responding to and managing cybersecurity incidents.
Security Information and Event Management (SIEM)
A system that collects and analyzes security event logs from multiple sources to detect and respond to security incidents.
Security Operations Center (SOC)
A centralized unit within an organization responsible for monitoring, detecting, and responding to security incidents.
Security Policy
A documented set of rules, guidelines, and practices that define an organization's security objectives, responsibilities, and requirements.
Social Engineering
The manipulation of individuals to deceive them into disclosing sensitive information or performing certain actions.
Social Media Security
The protection of individuals and organizations from security risks and threats associated with the use of social media platforms.
Software Development Life Cycle (SDLC)
A process framework for the development, testing, and maintenance of software, integrating security measures at each stage.
Spear Phishing
A targeted phishing attack that tailors its content and methods to deceive specific individuals or groups.
Spoofing
Impersonating a legitimate entity or source, such as a website, email address, or IP address, to deceive users or bypass security measures.
Spyware
Software that secretly gathers information about a user's activities, often without their knowledge or consent, and sends it to a remote server.
SQL Injection
A type of attack that exploits vulnerabilities in web applications by injecting malicious SQL commands into input fields.
Strategic Cyber Operations
Long-term, high-impact cyber operations conducted by military or government organizations to achieve strategic objectives in cyberspace.
Stuxnet
A sophisticated computer worm discovered in 2010, believed to be developed by nation-state actors for disrupting Iran's nuclear program.
Supply Chain Security
The protection of an organization's supply chain from cyber threats and vulnerabilities that could compromise the integrity or security of products or services.
Threat Actor
An individual, group, or organization responsible for carrying out cyber attacks or malicious activities, often categorized by motivation, capability, or tactics.
Threat Hunting
Proactive and iterative searching for signs of potential threats or indicators of compromise within an organization's networks and systems.
Threat Intelligence
Information about potential or current cyber threats, including threat actors, their methods, and indicators of compromise.
Threat Intelligence Analyst
A cybersecurity professional who specializes in collecting, analyzing, and interpreting threat intelligence data to support proactive defenses.
Threat Intelligence Exchange
The secure and structured sharing of threat intelligence information between different security systems, tools, or organizations.
Threat Intelligence Feed
A curated stream of threat intelligence data, often provided by security vendors or research organizations, used to enhance threat detection and response capabilities.
Threat Intelligence Fusion
The process of integrating and correlating multiple sources of threat intelligence data to gain a comprehensive understanding of the threat landscape.
Threat Intelligence Lifecycle
The end-to-end process of threat intelligence, including planning, collection, analysis, dissemination, and feedback for continuous improvement.
Threat Intelligence Platform
A software or service that aggregates, analyzes, and presents threat intelligence data to support threat detection and response.
Threat Intelligence Platform (TIP)
A software or platform that enables the collection, storage, analysis, and sharing of threat intelligence data across an organization.
Threat Intelligence Report
A structured document that provides actionable insights, analysis, and recommendations based on threat intelligence findings.
Threat Intelligence Sharing
The collaborative exchange of threat intelligence information between organizations, sharing insights and indicators to strengthen collective defenses.
Threat Intelligence-driven Defense
A proactive security approach that leverages threat intelligence to identify, block, and respond to threats before they can cause harm.
Threat Landscape Analysis
The assessment and understanding of the current and evolving threat landscape, including emerging threats, trends, and potential impacts.
Threat Modeling
The process of identifying and assessing potential threats, vulnerabilities, and impacts to prioritize and guide security measures and defenses.
Threat Vector
The method or path used by threat actors to exploit vulnerabilities and carry out cyber attacks, such as phishing, malware, or social engineering.
Tokenization
The process of substituting sensitive data with unique tokens, reducing the risk of unauthorized access or exposure.
Tor (The Onion Router)
A network that enables anonymous communication by routing internet traffic through a series of volunteer-operated relays.
TTPs (Tactics, Techniques, and Procedures)
The methods, tools, and approaches used by threat actors to carry out cyber attacks, often used to profile and attribute attacks.
Two-Factor Authentication (2FA)
A security measure that requires users to provide two different forms of identification, typically a password and a unique code sent to their mobile device, for accessing an account or system.
Unified Threat Management (UTM)
A comprehensive security solution that combines multiple security features, such as firewall, antivirus, intrusion detection, and content filtering, into a single device or platform.
Virtual Private Network (VPN)
A secure, encrypted connection that allows users to access a private network over a public network, such as the internet.
Virus
A type of malicious software that can replicate itself and spread from one computer to another, often causing damage or disrupting system operations.
Vulnerability
A weakness or flaw in a system, network, or software that could be exploited by attackers to gain unauthorized access or perform unauthorized actions.
Vulnerability Assessment
The systematic process of identifying, quantifying, and prioritizing vulnerabilities in systems or networks.
Wardriving
The act of searching for and mapping wireless networks, typically done with the aim of identifying insecure or vulnerable networks.
Watering Hole Attack
A cyber attack that targets a specific group of individuals by infecting websites they are likely to visit, exploiting trust in those sites.
Web Application Firewall (WAF)
A security control that monitors and filters HTTP/HTTPS traffic to and from web applications, protecting against web-based attacks.
Web Application Penetration Testing
The evaluation of the security of a web application by simulating attacks to identify vulnerabilities in its design, implementation, or configuration.
White Box Testing
A type of penetration testing where the tester has full knowledge of the system's architecture, design, and internal workings.
Wireless Network Security
The protection of wireless networks from unauthorized access, interception, or manipulation through the implementation of security protocols and measures.
Wireless Penetration Testing
The evaluation of the security of wireless networks and devices, such as Wi-Fi networks or Bluetooth devices, to identify vulnerabilities or unauthorized access points.
XSS (Cross-Site Scripting)
A type of web vulnerability that allows attackers to inject malicious scripts into web pages viewed by users.
Zero Trust
A security model that assumes no trust by default, requiring strict access controls and verification for every user and device.
Zero-day
A vulnerability in software or hardware that is unknown to the vendor and has no available patch or fix.
Zero-Day Exploit
A vulnerability in software or hardware that is unknown to the vendor and has no available patch or fix, often used as a powerful weapon in cyber warfare.
Zombie
A compromised computer or device that is under the control of an attacker, typically part of a botnet.
