Explained
Security terms, explained
The protocols, technologies, attacks and defences that come up in the news, in plain language. Stories link here whenever they mention one.
Protocols
12 protocol terms
- ProtocolBGP · Border Gateway ProtocolHow the networks that make up the internet announce which addresses they can reach.
- ProtocolDNS · Domain Name SystemThe internet's phone book: it turns names like example.com into the addresses computers connect to.
- ProtocolDTLS · Datagram Transport Layer SecurityTLS adapted for UDP: the same encryption for traffic that can arrive out of order or not at all.
- ProtocolHTTPSHTTP, the language of the web, sent inside a TLS-encrypted connection.
- ProtocolKerberosThe ticket-based login protocol Windows domains use.
- ProtocolMCP · Model Context ProtocolA standard way to connect AI models to tools and data sources.
- ProtocolNTLMAn older Windows authentication protocol, still widely used and easy to relay.
- ProtocolRDP · Remote Desktop ProtocolMicrosoft's protocol for controlling a Windows machine's desktop over the network.
- ProtocolSSH · Secure ShellThe encrypted remote-login protocol administrators use to run commands on servers.
- ProtocolSSL · Secure Sockets LayerThe retired predecessor of TLS; the name lives on in product names such as OpenSSL and "SSL VPN".
- ProtocolTLS · Transport Layer SecurityThe encryption protocol behind HTTPS: it keeps traffic between two programs private and proves who the server is.
- ProtocolWHOISThe lookup service for who registered a domain name.
Technologies and platforms
15 technology terms
- TechnologyActive DirectoryMicrosoft's directory of users, computers and permissions that most corporate Windows networks are built on.
- TechnologyAI agentAn AI model that acts on its own: it plans steps, uses tools and takes actions, not just answers.
- TechnologyGitHub ActionsGitHub's automation that builds, tests and releases code, often with access to secrets.
- TechnologyKubernetesThe system most companies use to run and scale containerised applications across many servers.
- TechnologyLinux kernelThe core of Linux and Android: it controls hardware, memory and what every program is allowed to do.
- TechnologyLLM · Large language modelAn AI model trained on huge amounts of text to understand and generate language, such as ChatGPT or Claude.
- TechnologynpmThe package registry for JavaScript: millions of open-source libraries that projects install automatically.
- TechnologyOpenSSHThe most widely used SSH implementation, shipped with Linux, macOS and Windows.
- TechnologyOpenSSLThe open-source library that much of the internet uses to speak TLS and do cryptography.
- TechnologyOT / ICS · Operational technology / industrial control systemsThe computers that run physical processes: factories, power grids, water plants, building systems.
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- TechnologyPyPI · Python Package IndexThe package registry for Python libraries.
- TechnologyTorA network that hides who is talking to whom by relaying traffic through three volunteer-run servers.
- TechnologyUEFIThe firmware that starts a computer before the operating system loads.
- TechnologyVPN · Virtual private networkAn encrypted tunnel that puts a remote device on a private network, as if it were plugged in at the office.
Attacks
17 attack terms
- AttackBackdoorA hidden way back into a system that bypasses normal logins.
- AttackBootkitMalware that infects the boot process so it runs before the operating system.
- AttackBotnetA network of hijacked devices that an attacker controls remotely, often routers and cameras.
- AttackBusiness email compromise · BECFraud that uses a hijacked or spoofed work email account to redirect payments.
- AttackContainer escapeBreaking out of a container to reach the host machine and the other containers on it.
- AttackCredential stuffingTrying leaked or common passwords against many accounts until some work.
- AttackData extortionStealing data and threatening to publish it unless the victim pays.
- AttackDDoS · Distributed denial of serviceFlooding a service with traffic from many machines until it can't respond.
- AttackInfostealerMalware that grabs saved passwords, browser cookies and crypto wallets from an infected computer.
- AttackLiving off the landAttacking with tools already on the system, such as PowerShell, so nothing looks like malware.
- AttackPhishingMessages that impersonate someone trusted to get people to click, log in or pay.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- AttackPrompt injectionHiding instructions in content an AI reads, so it follows the attacker instead of its user.
- AttackRansomwareMalware that encrypts an organisation's systems and demands payment, often after stealing data to leak.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- AttackRootkitMalware that hides itself deep in the operating system to avoid detection.
- AttackSupply-chain attackCompromising a vendor, library or update so the attack reaches all of its customers at once.
Weaknesses
9 weakness terms
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- WeaknessCommand injectionGetting an application to run operating-system commands built from attacker input.
- WeaknessCross-site request forgery · CSRFTricking a logged-in user's browser into sending a request they never meant to make.
- WeaknessCross-site scripting · XSSGetting a website to run an attacker's JavaScript in other visitors' browsers.
- WeaknessInsecure deserializationTurning untrusted data back into program objects in a way that lets it run code.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- WeaknessPath traversalUsing ../ tricks in a file name to read or write files outside the intended folder.
- WeaknessServer-side request forgery · SSRFMaking a server fetch a URL of the attacker's choosing, often one inside the private network.
- WeaknessSQL injectionSlipping database commands into input an application passes to its database.
Defences
8 defence terms
- DefenceDNSSECDigital signatures on DNS answers, so a resolver can tell a genuine record from a forged one.
- DefenceEDR · Endpoint detection and responseSecurity software on laptops and servers that watches behaviour to detect and stop attacks.
- DefenceMFA · Multi-factor authenticationRequiring a second proof besides a password, such as an app prompt, a code or a security key.
- DefencePost-quantum cryptographyNew encryption designed to stay secure once large quantum computers can break today's public-key algorithms.
- DefenceSBOM · Software bill of materialsAn ingredient list of the components inside a piece of software.
- DefenceSecure BootA firmware check that only lets signed, trusted boot loaders start the computer.
- DefenceWAF · Web application firewallA filter in front of a website that blocks malicious requests such as SQL injection attempts.
- DefenceZero trustA security model that checks every access request instead of trusting anything inside the network.
Concepts
14 concept terms
- ConceptAPT · Advanced persistent threatA well-resourced hacking group, usually tied to a government, that runs long, targeted campaigns.
- ConceptCertificate authorityAn organisation trusted to vouch for a website's identity by signing its certificate.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
- ConceptCommand and control · C2The servers attackers use to send instructions to their malware and receive stolen data.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptEPSS · Exploit Prediction Scoring SystemA daily estimate of how likely a vulnerability is to be exploited in the next 30 days.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptInitial access brokerA criminal who breaks into networks and sells that access to others, such as ransomware gangs.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptPatch TuesdayMicrosoft's monthly security update day, the second Tuesday of every month.
- ConceptPKI · Public key infrastructureThe system of keys, certificates and authorities that lets strangers on a network trust each other's identity.
- ConceptProof of conceptA demonstration that a flaw can be exploited, usually published by researchers.
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.