Glossary
The words people assume you already know.
Plain-language definitions for the vocabulary you will meet in lessons, job adverts and incident calls. No circular definitions.
A
- ACL (Access Control List)
- A list attached to a file or resource that says which users or groups may do what. Windows uses ACLs; Unix-like systems use a compact permission mode alongside optional ACLs.
- ARP (Address Resolution Protocol)
- Finds the hardware (MAC) address that belongs to an IPv4 address on the local network. ARP spoofing redirects local traffic by lying about that mapping.
- Authentication
- Proving who you are. A password, passkey or security key is an authentication factor.
- Authorization
- Deciding what an authenticated identity may do. In security testing, it also means explicit permission to test a system — without it, testing is a crime.
- Availability
- The guarantee that systems and data are usable when needed. Ransomware and denial-of-service attacks primarily attack availability.
B
- Binary
- Base-2 notation using only 0 and 1. Computers represent data and instructions in binary.
- Bit / Byte
- A bit is one binary digit. Eight bits make a byte, which has 256 possible values and is the usual unit of storage.
C
- Certificate (TLS)
- A signed statement binding a public key to a domain, issued by a certificate authority. Browsers use it to authenticate HTTPS servers.
- CIA triad
- Confidentiality, integrity and availability: the three properties security controls try to preserve.
- CIDR
- Classless Inter-Domain Routing notation, such as 192.168.1.0/24. The suffix counts the network bits.
- Cookie
- A small piece of data a site stores in the browser and receives on later requests. Session cookies can act as bearer tokens, so they need protective flags.
D
- DHCP
- The protocol that automatically gives a device an IP address, gateway and DNS servers when it joins a network.
- DNS
- The system that maps human-readable names to IP addresses. A resolver walks the DNS hierarchy to find the authoritative answer.
E
- Encryption
- Reversible transformation of data using a key so that only key holders can read it. Hashing is not encryption because it is one-way.
F
- Firewall
- A control that permits or blocks network traffic according to rules. A stateful firewall remembers connections you started.
H
- Hash
- A one-way fingerprint of data. The same input always yields the same fixed-size output; a tiny change produces a completely different hash.
- HTTP / HTTPS
- The request/response protocol of the web, and its TLS-protected version. HTTPS encrypts the channel but does not make a site trustworthy.
I
- Integrity
- The property that data is accurate, complete and has not been changed without authorisation. Hashes, signatures and audit logs support it.
- IP address
- A numeric address for a device on a network. IPv4 is 32-bit; IPv6 is 128-bit. Private ranges are not routed on the public internet.
L
- Least privilege
- Giving every user and process only the access needed for its task, for only as long as needed. It limits the damage of a compromise.
M
- MFA
- Multi-factor authentication: requiring more than one independent factor, such as a password plus a passkey or authenticator code.
N
- NAT
- Network Address Translation. A router rewrites private addresses to share one public address. It hides internal addresses but is not a firewall.
P
- Packet
- A unit of network data with headers describing source, destination and protocol, plus a payload.
- Phishing
- Tricking someone into revealing credentials, approving access or running something. It is a delivery method for many attacks, not a single technique.
- Port
- A 16-bit number that identifies a service on a host. Common numbers are conventions; a service can listen on any port.
R
- Ransomware
- Malware that encrypts or steals data and demands payment. Backups, segmentation and quick detection are the practical defences.
- Risk
- The combination of how likely a harmful event is and how much damage it would cause. Risk can be mitigated, transferred, avoided or accepted.
S
- Scope
- The systems, techniques and time window a security test is authorised to cover. Anything outside scope is out of bounds, even if vulnerable.
- SIEM
- Security Information and Event Management: a platform that collects logs, correlates events and raises alerts for analysts.
- Social engineering
- Manipulating people into taking an unsafe action. Phishing, vishing and pretexting are common forms.
- Subnet
- A logical division of a network. CIDR notation describes the network portion; the remaining bits identify hosts.
T
- TCP / UDP
- TCP is connection-oriented and retransmits lost data. UDP is connectionless and lighter, used where speed matters more than guaranteed delivery.
- Threat model
- A structured look at what you are protecting, from whom, across which trust boundaries, and which controls reduce the risk.
- TLS
- Transport Layer Security, the protocol behind HTTPS. It provides confidentiality and integrity in transit, not honesty or endpoint security.
V
- Vulnerability
- A weakness that a threat could use. A vulnerability alone is not a breach; it needs a threat, a path and often a mistake.
- VPN
- A virtual private network that encrypts traffic between a device and a gateway. It moves trust to the VPN provider; it does not make you anonymous.
Z
- Zero-day
- A vulnerability with no vendor patch available. Most real incidents use known, patchable weaknesses instead.