Glossary · Security0-RTT (TLS Early Data)0-RTT lets a returning TLS 1.3 client send application data in its first flight, saving a round trip but exposing that data to replay attacks.Glossary · SecurityACME Challenge (HTTP-01 and DNS-01)An ACME challenge is the test a CA sets to confirm you control a domain, usually by serving a file over HTTP or publishing a DNS TXT record.Glossary · SecurityACME ProtocolACME is the standard protocol that lets software prove domain control to a certificate authority and obtain TLS certificates automatically.Glossary · SecurityAdwareAdware is software that shows unwanted advertisements, often bundled with free programs, and sometimes tracks browsing behaviour or injects ads into web pages.Glossary · SecurityAir GapAn air gap is a security measure that physically isolates a computer or network from the internet and other networks to protect sensitive systems.Glossary · SecurityALPN (Application-Layer Protocol Negotiation)ALPN is a TLS extension that lets client and server agree on the application protocol, such as h2 or http/1.1, during the handshake.Glossary · SecurityAsymmetric EncryptionAsymmetric encryption uses a mathematically linked pair of keys, a public key that encrypts or verifies and a private key that decrypts or signs.Glossary · SecurityAttack SurfaceAn attack surface is the sum of all points where an unauthorised party could try to enter, interact with or extract data from a system.Glossary · SecurityBackdoorA backdoor is a hidden way to access a system that bypasses normal authentication, installed by an attacker or left in software deliberately or by mistake.Glossary · SecurityBlue TeamA blue team is the group that defends an organisation by monitoring, detecting, investigating and responding to threats and by improving its security controls.Glossary · SecurityBot ManagementBot management is the set of techniques that identify automated traffic and decide whether to allow, challenge, slow or block it.Glossary · SecurityBotnetA botnet is a network of internet-connected devices infected with malware and remotely controlled by an attacker, typically used for DDoS attacks and spam.Glossary · SecurityBrute Force AttackA brute force attack tries many passwords or keys in rapid succession until one works, which is slowed by strong secrets and rate limiting.Glossary · SecurityBug BountyA bug bounty is a programme where an organisation rewards outside researchers for responsibly reporting security vulnerabilities in its systems.Glossary · SecurityCAA Record (Certification Authority Authorization)A CAA record lists which certificate authorities may issue TLS certificates for a domain, and CAs must check it before issuing.Glossary · SecurityCCPAThe CCPA is a California privacy law giving residents the right to know, delete and opt out of the sale or sharing of their personal information by businesses.Glossary · SecurityCertificate Authority (CA)A certificate authority is a trusted organization that verifies control of a domain and signs the TLS certificates browsers rely on to trust a website.Glossary · SecurityCertificate Chain (Chain of Trust)A certificate chain is the ordered path of certificates from a server's leaf certificate through intermediates up to a trusted root.Glossary · SecurityCertificate Expiry AlertA certificate expiry alert is a notification sent when a TLS certificate is within a set number of days of its expiration date.Glossary · SecurityCertificate PinningCertificate pinning makes a client accept only specific certificates or public keys for a server, blocking valid but unexpected certificates.Glossary · SecurityCertificate Transparency (CT)Certificate Transparency is a public, append-only logging system that records every issued TLS certificate so mis-issuance can be detected.Glossary · SecurityCipher SuiteA cipher suite is a named bundle of algorithms for key exchange, authentication, bulk encryption and integrity used in a TLS connection.Glossary · SecurityClickjackingClickjacking tricks a user into clicking something different from what they see by overlaying a hidden or disguised page, often inside a transparent iframe.Glossary · SecurityClient CertificateA client certificate is an X.509 certificate presented by the connecting client, not the server, so the server can verify who or what is calling.Glossary · SecurityCode Signing CertificateA code signing certificate lets a developer digitally sign software so users and operating systems can verify who published it and that it was not altered.Glossary · SecurityCookie ConsentCookie consent is the process of informing visitors about cookies and obtaining their permission before setting non-essential ones, as privacy laws require.Glossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityCORS (Cross-Origin Resource Sharing)CORS is a browser mechanism that uses HTTP headers to let a server permit specific other origins to read its responses, relaxing the same-origin policy.Glossary · SecurityCORS Preflight RequestA CORS preflight is an automatic OPTIONS request a browser sends to check whether a cross-origin request is allowed before sending it.Glossary · SecurityCredential StuffingCredential stuffing is an automated attack that tries username and password pairs leaked from one breach against many other sites, exploiting password reuse.Glossary · SecurityCRL (Certificate Revocation List)A CRL is a signed list published by a certificate authority naming certificates that were revoked before their expiry date.Glossary · SecurityCSP (Content Security Policy)Content Security Policy is an HTTP header that lists which sources a page may load scripts, styles and other resources from, limiting the damage of XSS attacks.Glossary · SecurityCSP NonceA CSP nonce is a random, single-use token that marks specific inline scripts or styles as allowed under a Content Security Policy.Glossary · SecurityCSR (Certificate Signing Request)A CSR is a signed message containing your public key and domain details that you send to a CA to request a TLS certificate.Glossary · SecurityCSRF (Cross-Site Request Forgery)CSRF is an attack that tricks a logged-in user's browser into sending an unwanted request to a site where they are authenticated.Glossary · SecurityCVE (Common Vulnerabilities and Exposures)A CVE is a unique public identifier, such as CVE-2021-44228, assigned to a specific publicly disclosed cybersecurity vulnerability.Glossary · SecurityCVSS (Common Vulnerability Scoring System)CVSS is an open standard that rates the severity of a software vulnerability on a scale from 0.0 to 10.0 based on measurable characteristics.Glossary · SecurityDANE (DNS-Based Authentication of Named Entities)DANE publishes TLS certificate or key fingerprints in DNSSEC-signed TLSA records so clients can verify a server without relying only on CAs.Glossary · SecurityData BreachA data breach is an incident in which confidential, protected or personal data is accessed, disclosed or stolen by someone not authorized to have it.Glossary · SecurityDDoS (Distributed Denial of Service)A DDoS attack floods a server or network with traffic from many sources at once, exhausting bandwidth or resources so legitimate users cannot reach the site.Glossary · SecurityDeepfake (Security)A deepfake is synthetic audio, image or video created with AI to imitate a real person, which attackers can misuse for fraud, impersonation and disinformation.Glossary · SecurityDiffie-Hellman Key ExchangeDiffie-Hellman lets two parties agree on a shared secret over a public channel without ever sending the secret itself, the basis of TLS key exchange.Glossary · SecurityDigital SignatureA digital signature is a cryptographic value created with a private key that proves who signed data and that it has not been altered.Glossary · SecurityDirectory Traversal (Path Traversal)Directory traversal is a flaw where unsanitised file paths let a request reach files outside the intended folder, using sequences such as ../.Glossary · SecurityDNSSEC (DNS Security Extensions)DNSSEC adds cryptographic signatures to DNS records so validating resolvers can detect forged or tampered answers.Glossary · SecurityDomain Validation (DV) CertificateA DV certificate is issued after the CA verifies only that you control the domain, with no check of who you are as an organization.Glossary · SecurityDrive-by DownloadA drive-by download is an unintended download or infection triggered simply by visiting a compromised or malicious web page, often via an unpatched browser.Glossary · SecurityElliptic Curve Cryptography (ECC)Elliptic curve cryptography is public-key cryptography built on elliptic curve math, giving strong security with much smaller keys than RSA.Glossary · SecurityEncrypted Client Hello (ECH)Encrypted Client Hello is a TLS extension that encrypts the first handshake message, hiding the requested hostname (SNI) from network observers.Glossary · SecurityEncryptionEncryption is the process of scrambling readable data into ciphertext with an algorithm and a key so only authorized parties can read it.Glossary · SecurityEncryption at RestEncryption at rest protects stored data on disks, databases and backups by encrypting it, so stolen media or files are unreadable without the key.Glossary · SecurityEnd-to-End Encryption (E2EE)End-to-end encryption encrypts messages on the sender's device so only the recipient's device can decrypt them, not even the service provider.Glossary · SecurityEV (Extended Validation) CertificateAn EV certificate is issued after a CA verifies the legal identity of an organization, but browsers no longer give it special visual treatment.Glossary · SecurityForward Secrecy (PFS)Forward secrecy means each TLS session uses its own temporary keys, so stealing a server's private key later cannot decrypt past traffic.Glossary · SecurityGDPRThe GDPR is the European Union's data protection regulation that governs how organizations collect, use and protect personal data of people in the EU.Glossary · SecurityHardeningHardening is the process of reducing a system's vulnerabilities by removing unneeded features, tightening settings and applying secure configuration.Glossary · SecurityHashingHashing converts input of any size into a fixed-length digest with a one-way function, so the same input always gives the same output but cannot be reversed.Glossary · SecurityHeartbleed (CVE-2014-0160)Heartbleed was a 2014 OpenSSL bug that let attackers read chunks of a server's memory, including private keys and session data, over TLS.Glossary · SecurityHoneypotA honeypot is a decoy system or service built to look valuable so that defenders can detect, study and learn from unauthorized access attempts.Glossary · SecurityHSM (Hardware Security Module)An HSM is a tamper-resistant device that generates and stores cryptographic keys and performs signing operations without ever exposing the private key.Glossary · SecurityHSTS (HTTP Strict Transport Security)HSTS is a response header that tells browsers to use HTTPS only for your domain, blocking downgrade attacks and skipping insecure HTTP redirects.Glossary · SecurityHSTS Preload ListThe HSTS preload list is a list of domains built into browsers that must always use HTTPS, even on the first visit before any header is seen.Glossary · SecurityHTTP Request SmugglingHTTP request smuggling exploits disagreements between a front-end proxy and back-end server about where one request ends and the next begins.Glossary · SecurityHttpOnly CookieThe HttpOnly flag marks a cookie so that browser JavaScript cannot read it, which limits theft of session cookies through cross-site scripting.Glossary · SecurityIDS and IPS (Intrusion Detection and Prevention Systems)An IDS watches network or host activity and raises alerts on suspicious behaviour; an IPS sits inline and can also block the traffic it flags.Glossary · SecurityInsider ThreatAn insider threat is a security risk from people with legitimate access, such as employees or contractors, who misuse it deliberately or by accident.Glossary · SecurityIntermediate CertificateAn intermediate certificate is issued by a root CA and used to sign your server certificate, linking it back to a trusted root.Glossary · SecurityJWT (JSON Web Token)A JWT is a compact, signed token containing JSON claims about a user or session, widely used to carry identity and permissions between services.Glossary · SecurityKey ManagementKey management is the practice of generating, storing, rotating, distributing and retiring cryptographic keys securely throughout their lifecycle.Glossary · SecurityKey Pair (Public and Private Key)A key pair is a mathematically linked public key and private key used for encryption, signatures and TLS authentication.Glossary · SecurityKeyloggerA keylogger is software or hardware that secretly records what a person types, aiming to capture passwords, messages and other sensitive input.Glossary · SecurityLateral MovementLateral movement is how an intruder who has gained one foothold explores a network and moves between systems to reach more valuable targets.Glossary · SecurityLet's EncryptLet's Encrypt is a free, automated, nonprofit certificate authority that issues short-lived domain-validated TLS certificates via ACME.Glossary · SecurityMalwareMalware is any software deliberately designed to damage systems, steal data or gain unauthorized access, including viruses, trojans, ransomware and spyware.Glossary · SecurityMan-in-the-Middle AttackA man-in-the-middle attack secretly intercepts or alters communication between two parties who believe they are talking directly to each other.Glossary · SecurityMan-in-the-Middle Attack (MITM)A man-in-the-middle attack places an attacker between two parties so they can read or alter traffic that both sides believe is private.Glossary · SecurityMFA (Multi-Factor Authentication)MFA is an authentication approach that requires two or more independent proofs of identity, such as a password, a device and a fingerprint.Glossary · SecurityMFA Fatigue (Push Bombing)MFA fatigue is an attack in which someone with a stolen password floods the victim with approval prompts until they accept one out of annoyance or confusion.Glossary · SecurityMixed ContentMixed content is an HTTPS page that loads some resources, such as scripts or images, over plain HTTP, weakening or breaking its security.Glossary · SecuritymTLS (Mutual TLS)Mutual TLS is a TLS setup in which both the server and the client present certificates, so each side authenticates the other.Glossary · SecurityOAuthOAuth is an authorization standard that lets an app obtain limited access to your account on another service through tokens, without receiving your password.Glossary · SecurityOCSP (Online Certificate Status Protocol)OCSP lets a client ask a certificate authority in real time whether a specific TLS certificate has been revoked, instead of downloading a full list.Glossary · SecurityOCSP Must-StapleOCSP Must-Staple is a certificate flag that tells browsers to reject the certificate unless the server staples a valid OCSP response.Glossary · SecurityOCSP StaplingOCSP stapling lets your server attach a recent, CA-signed revocation status to the TLS handshake so browsers need not query the certificate authority.Glossary · SecurityOpen RedirectAn open redirect is a flaw where a site forwards users to any address given in a parameter, letting attackers make malicious links look trustworthy.Glossary · SecurityOrganization Validation (OV) CertificateAn OV certificate is a TLS certificate where the CA verified the organization behind the domain as well as domain control, and lists it in the certificate.Glossary · SecurityOWASP Top 10The OWASP Top 10 is a regularly updated awareness list of the most critical web application security risks, published by OWASP.Glossary · SecurityPasskeyA passkey is a phishing-resistant passwordless credential based on public-key cryptography, unlocked by your fingerprint, face or device PIN.Glossary · SecurityPassword ManagerA password manager is an app that generates, stores and fills strong unique passwords for every account, protected by one master password.Glossary · SecurityPatch (Software)A patch is a software update that fixes bugs or closes security vulnerabilities, and applying it promptly is one of the most effective defenses.Glossary · SecurityPatch ManagementPatch management is the ongoing process of identifying, testing, deploying and verifying software updates, especially those that fix security vulnerabilities.Glossary · SecurityPenetration TestingPenetration testing is an authorized, simulated attack on a system by security professionals to find exploitable weaknesses before real attackers do.Glossary · SecurityPermissions-PolicyPermissions-Policy is a response header that allows or blocks browser features such as camera, microphone and geolocation for a site and its frames.Glossary · SecurityPhishingPhishing is a social engineering attack that uses fake emails, messages or websites to trick people into giving up credentials, money or access.Glossary · SecurityPII (Personally Identifiable Information)PII is any information that can identify a specific person, alone or combined with other data, such as a name, email address, ID number or phone number.Glossary · SecurityPrinciple of Least PrivilegeThe principle of least privilege means giving every user, program and service only the minimum access needed to do its job, and nothing more.Glossary · SecurityPrivate KeyA private key is the secret half of an asymmetric key pair, used to decrypt data and create digital signatures, and it must never be shared.Glossary · SecurityPrivilege EscalationPrivilege escalation is gaining higher access rights than were granted, such as user to administrator, by abusing a flaw or misconfiguration.Glossary · SecurityPublic KeyA public key is the shareable half of an asymmetric key pair, used to encrypt data for its owner or to verify the owner's digital signatures.Glossary · SecurityRansomwareRansomware is malware that encrypts a victim's files or systems and demands payment for the key, often also threatening to leak stolen data.Glossary · SecurityRate LimitingRate limiting caps how many requests a client can make in a time window, protecting servers and APIs from abuse and overload by returning HTTP 429.Glossary · SecurityRed TeamA red team is a group that simulates a realistic adversary against an organisation, testing its people, processes and technology to expose security gaps.Glossary · SecurityReferrer-PolicyReferrer-Policy is a response header that controls how much of the originating page's URL browsers send in the Referer header.Glossary · SecurityRemote Code Execution (RCE)Remote code execution is a vulnerability class that lets an outside party run their own code on a target system over a network, often giving broad control.Glossary · SecurityRoot Store (Trust Store)A root store is the collection of trusted root certificates that an operating system, browser or runtime uses to validate TLS certificates.Glossary · SecurityRootkitA rootkit is malware designed to hide its own presence and other malicious activity by tampering with the operating system, firmware or security tools.Glossary · SecurityRSA (Rivest-Shamir-Adleman)RSA is a public-key algorithm used for digital signatures and encryption, and for years the default key type inside web server certificates.Glossary · SecuritySame-Origin PolicyThe same-origin policy is a browser rule that stops scripts on one origin from reading data from another origin unless that origin permits it.Glossary · SecuritySameSite Cookie AttributeSameSite controls whether a browser sends a cookie on cross-site requests, with Strict, Lax and None values, helping reduce CSRF and tracking.Glossary · SecuritySAMLSAML is an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider, for enterprise SSO.Glossary · SecuritySAN Certificate (Subject Alternative Name)A SAN certificate lists several hostnames in its Subject Alternative Name field, so one certificate can secure many domains and subdomains at once.Glossary · SecuritySandboxing (Security)Sandboxing runs code or files in a restricted, isolated environment so that if they are malicious or buggy, the damage cannot spread to the rest of the system.Glossary · SecurityScarewareScareware uses fake warnings, such as bogus virus alerts, to frighten people into installing malicious software or paying for a useless product.Glossary · SecuritySecure Cookie FlagThe Secure attribute tells browsers to send a cookie only over HTTPS, so it is not exposed in plain text on unencrypted connections.Glossary · SecuritySecurity AuditA security audit is a systematic review of systems, policies and controls against a standard to find gaps and verify that protections work as intended.Glossary · SecuritySecurity HeadersSecurity headers are HTTP response headers that instruct browsers to enable protections such as HTTPS enforcement, script restrictions and framing controls.Glossary · SecuritySelf-Signed CertificateA self-signed certificate is signed with its own private key instead of a CA's, so browsers do not trust it unless manually told to.Glossary · SecuritySession FixationSession fixation is an attack where an attacker sets a victim's session ID before login, then reuses it after the victim authenticates.Glossary · SecuritySession HijackingSession hijacking is an attack where someone steals or guesses a valid session ID or token and uses it to impersonate a logged-in user without their password.Glossary · SecuritySIEM (Security Information and Event Management)A SIEM collects logs and events from many systems into one place, correlates them and raises alerts so security teams can spot and investigate incidents.Glossary · SecuritySIM SwappingSIM swapping is fraud in which an attacker persuades a mobile carrier to move a victim's phone number to a SIM they control, intercepting calls and texts.Glossary · SecuritySlowlorisSlowloris is a denial-of-service attack that holds many connections open by sending HTTP requests extremely slowly, exhausting the server's connection capacity.Glossary · SecuritySmishing (SMS Phishing)Smishing is phishing carried out through text messages, tricking recipients into clicking malicious links or sharing sensitive information.Glossary · SecuritySNI (Server Name Indication)SNI is a TLS extension where the client states the hostname it wants, so one IP address can serve certificates for many domains.Glossary · SecuritySocial EngineeringSocial engineering is the manipulation of people into divulging confidential information or taking harmful actions, exploiting trust, not technical flaws.Glossary · SecuritySpear PhishingSpear phishing is a targeted phishing attack tailored to a specific person or organization using personal details to make the message look credible.Glossary · SecuritySQL InjectionSQL injection is a web vulnerability where unsanitized user input is interpreted as part of a database query, allowing data to be read or changed.Glossary · SecuritySSL StrippingSSL stripping is a man-in-the-middle attack that keeps a victim on plain HTTP by removing the redirect to HTTPS.Glossary · SecuritySSL/TLS (Transport Layer Security)TLS is the protocol that encrypts and authenticates connections between a browser and a server; SSL is its deprecated predecessor, still used as a name.Glossary · SecuritySSO (Single Sign-On)SSO is an authentication scheme where one login with a central identity provider grants access to many separate applications without new passwords.Glossary · SecuritySSRF (Server-Side Request Forgery)SSRF is a vulnerability where an attacker makes a server send requests to destinations of the attacker's choosing, often reaching internal systems.Glossary · SecuritySubdomain TakeoverA subdomain takeover happens when a DNS record points to a deleted external service, letting an attacker claim it and serve content on your domain.Glossary · SecuritySubresource Integrity (SRI)Subresource Integrity lets a page declare a cryptographic hash for a script or stylesheet so the browser refuses to run the file if it has been altered.Glossary · SecuritySymmetric EncryptionSymmetric encryption uses a single shared secret key to both encrypt and decrypt data, making it fast and well suited to large amounts of data.Glossary · SecurityThreat ModelingThreat modeling is a structured way to identify what could go wrong in a system, who might attack it, and which defences to build before problems occur.Glossary · SecurityTLS 1.3TLS 1.3 is the current major version of the TLS protocol, with a faster one-round-trip handshake and only modern, forward-secret cryptography.Glossary · SecurityTLS Downgrade AttackA TLS downgrade attack forces a client and server to negotiate an older, weaker protocol version or cipher instead of the best one both support.Glossary · SecurityTLS Session ResumptionTLS session resumption lets a returning client skip the full handshake by reusing earlier session secrets via a session ID or ticket.Glossary · SecurityTLS TerminationTLS termination is when a load balancer, CDN or reverse proxy decrypts HTTPS traffic and forwards requests to backend servers.Glossary · SecurityTrojan HorseA trojan is malware disguised as legitimate software that tricks users into installing it, then performs hidden malicious actions.Glossary · SecurityTwo-Factor Authentication (2FA)Two-factor authentication requires two different kinds of proof, such as a password plus a code from your phone, before it grants access to an account.Glossary · SecurityVishing (Voice Phishing)Vishing is phishing by phone call or voice message, where an impersonator pressures someone into revealing credentials, codes or making payments.Glossary · SecurityVulnerabilityA vulnerability is a weakness in software, hardware, configuration or process that an attacker could exploit to harm confidentiality, integrity or availability.Glossary · SecurityVulnerability ScannerA vulnerability scanner is a tool that automatically checks systems, networks or applications for known weaknesses, misconfigurations and missing patches.Glossary · SecurityWAF (Web Application Firewall)A web application firewall inspects HTTP requests and blocks malicious ones, such as SQL injection or bot floods, before they reach your application.Glossary · SecurityWhalingWhaling is a highly targeted phishing attack aimed at senior executives or other high-value individuals, using tailored, convincing messages.Glossary · SecurityWildcard CertificateA wildcard certificate uses an asterisk, like *.example.com, to secure every first-level subdomain of a domain with a single TLS certificate.Glossary · SecurityX-Content-Type-OptionsX-Content-Type-Options: nosniff is a response header that stops browsers from guessing a file's type and forces them to respect the declared MIME type.Glossary · SecurityX-Frame-OptionsX-Frame-Options is a response header that tells browsers whether a page may be displayed inside a frame or iframe, used to prevent clickjacking.Glossary · SecurityXSS (Cross-Site Scripting)XSS is a web vulnerability where an attacker gets a site to deliver malicious JavaScript to other users, running in the context of that trusted site.Glossary · SecurityXXE (XML External Entity)XXE is a vulnerability where an XML parser processes external entity references in untrusted input, potentially exposing files or triggering internal requests.Glossary · SecurityZero TrustZero trust is a security model that assumes no user or device is trusted by default and verifies every access request regardless of network location.Glossary · SecurityZero-DayA zero-day is a software vulnerability unknown to the vendor, or without a released fix, that attackers can exploit before defenders can respond.