Glossary
CVE, CVSS, RCE, SSRF, XSS, SPF/DKIM/DMARC — each term with a one-line answer and a plain explanation.
What is shadow AI? The risks of AI use your company can't see, and what organizations and individuals should do
Shadow AI is employees using AI tools the company hasn't approved or doesn't manage (chatbots, AI browser extensions, coding assistants, meeting-note AI, AI agents connected to work accounts) for work. It's the AI form of shadow IT. The mai…
What is a backdoor — how attackers keep their way in, and how to spot it
A backdoor is a hidden entry point planted so an attacker can return while bypassing normal authentication. It usually follows an initial breach and turns one intrusion into ongoing access; it can also arrive inside a poisoned dependency. W…
What is GDPR: the EU's data-protection rules and breach-notification duty
GDPR (General Data Protection Regulation) is the EU's comprehensive rulebook for protecting the personal data of people in the EU — and it can reach businesses outside the EU that serve EU users. It requires a lawful basis (e.g. consent), c…
What is the OWASP Top 10: the standard list of the 10 biggest web-app risks
The OWASP Top 10 is a list the non-profit OWASP publishes every few years of the 'most critical web-app risks.' It's a common language for developers and operators. The current 2025 edition (announced November 2025) is still led by Broken A…
What is PCI DSS: the security standard for handling credit-card data
PCI DSS (Payment Card Industry Data Security Standard) is the international standard for businesses that store, process, or transmit card data. Set by the card brands, it requires network protection, encryption of stored data, least-privile…
What is public-key cryptography: encrypting and signing with a key pair
Public-key crypto uses a 'public key' (safe to hand out) and a 'private key' (held only by the owner). Anything encrypted with the public key can only be decrypted by the matching private key, and a signature made with the private key can b…
What is malware? Types, infection routes, and the basic defenses
Malware (malicious software) is the umbrella term for software built to harm your devices or data. Viruses, worms, trojans, ransomware, spyware, and bots are all types under it. However different they look, the defense is the same three par…
What is a one-time password (OTP)? TOTP vs HOTP vs SMS, and its limits
A one-time password (OTP) is a short-lived, single-use code that becomes invalid once used. Types: authenticator-app TOTP (time-based), HOTP (counter-based), and SMS-OTP. It's strong against leaked and reused passwords and is commonly the '…
What is two-factor authentication (2FA)? vs two-step, and the strength of each method
Two-factor authentication (2FA) strengthens identity checks by adding a different category of proof — 'something you have' or 'something you are' (a code, key, or biometric) — on top of 'something you know' (your password). It is strictly n…
What is Let's Encrypt — the free CA that automates HTTPS
Let's Encrypt = a free, automated TLS certificate authority (CA). The ACME protocol verifies domain control automatically, so issuance and renewal are hands-off. Certificates are short-lived (90 days) by design — to shrink the window of a k…
What is OpenSSL? The library that handles HTTPS encryption, and how to keep it safe
OpenSSL = the open-source library that powers HTTPS (TLS/SSL) and crypto. Most people never write it directly — they inherit it via the web server, OS, or language runtime. That's why one bug has an enormous impact (Heartbleed is the classi…
What is a passkey? Public-key login, phishing resistance and sync
A passkey authenticates with a private-key signature, while the login service holds the public key. Synced passkeys can transfer encrypted credentials between devices; device-bound passkeys do not sync. MFA depends on required user verifica…
What is password hashing? Storing passwords safely with a one-way transform
Password hashing means storing a password as a one-way, non-reversible transform. Never store plaintext. Unlike encryption you can't decrypt it back — that's the point. But plain MD5/SHA-256 falls to rainbow tables and brute force. The fix:…
What is a salt? The random per-user value added when hashing passwords
A salt is a random, per-user value added before hashing a password. The same password then stores differently for every user, which defeats precomputed rainbow tables and stops one cracking run from breaking many accounts. A salt is not sec…
What is phishing? The types of attack, and defenses more reliable than spotting it
Phishing impersonates a trusted party to lure you to a fake login page and steal credentials or data (or run malware). It targets human judgment rather than a software flaw, and is the number-one entry route for ransomware and breaches. Mod…
What is a JWT (JSON Web Token)? How signed tokens work and how to use them safely
A JWT is a token a server signs and issues so that tampering can be detected. It has three parts — header.payload.signature — and the server verifies the signature to confirm authenticity. Watch out for: (1) always verify the signature and…
What is ransomware? How it works, how it gets in, and how to avoid paying
Ransomware is malware that encrypts your files and demands payment to get them back. Modern attacks add double extortion — they steal data first and threaten to leak it, so decryption alone doesn't stop the breach. Main entry routes: phishi…
What is BitLocker: Windows disk encryption that protects data on a lost or stolen device
BitLocker is Windows' built-in disk encryption. It protects data when the PC is off or the drive is removed, turning a theft or loss into ciphertext. The main thing to get right is the recovery key: lose it and you lock yourself out. It doe…
What is C2 (command and control): the channel attackers use to control a device after a breach
C2 is the channel a compromised device uses to call back to an attacker's server (a beacon) to receive commands and exfiltrate data — the stage after a breach. The main clues are suspicious periodic outbound traffic and known-bad destinatio…
What is CORS — how it works, and what a misconfiguration exposes
CORS is how the browser controls whether another origin's JS can read your API responses. A misconfiguration — reflecting any Origin, or Access-Control-Allow-Origin:* with credentials — lets a third-party site read logged-in data. The basic…
What is EDR: recording endpoint activity to detect and respond to attacks that get past antivirus
EDR continuously records endpoint behavior, detects suspicious activity (IOA-style), and supports response (isolate, investigate). It catches fileless and living-off-the-land attacks that signature/IOC-based antivirus misses, via behavior a…
What is an IOA (Indicator of Attack): spotting a breach by behavior, not traces
An IOA (Indicator of Attack) spots a breach by the behavior of an attack in progress (privilege escalation → lateral movement → exfiltration). It's the counterpart to the after-the-fact IOC. Attackers swap hashes and IPs instantly, but the…
What is an IOC (Indicator of Compromise): traces that reveal a breach
An IOC (Indicator of Compromise) is a trace a breach leaves behind — known-bad file hashes, attacker IPs/domains, URLs, unusual processes. Its value is mechanically detecting/blocking known-bad. But it's a reactive clue attackers can swap c…
What is session fixation — making a victim log in with an ID the attacker already knows
Session fixation makes a victim use an attacker-known session ID, then impersonates them after they log in with it. The main defense: regenerate the session ID on login (and on privilege change). Don't accept IDs from the URL, and set HttpO…
What is clickjacking? An attack that makes you click buttons on a transparent page laid over another
Clickjacking layers your real site invisibly over an attacker's page so the user performs an unintended action (transfer, settings change, consent). The main defense is refusing to be framed: CSP frame-ancestors plus X-Frame-Options.
What is IDOR: a flaw that exposes other people's data when an ID is changed
IDOR lets a user change ?id=124 to 125 and read someone else's invoice or personal data — broken access control. The main defense: server-side, check on every access whether the logged-in user is allowed this object. Hard-to-guess IDs are n…
What is open redirect: a flaw that forwards users from your trusted URL to another site
An open redirect lets a ?next= style parameter forward users to any external site, borrowing your trusted domain for phishing. The main defense: never accept external URLs as redirect targets; use relative paths and an allowlist only.
What is path traversal — reading files the server should never serve, via ../
Path traversal mixes ../ into a filename input to escape the base directory and read/write .env, config, or keys. The main defense: never use user input as a raw file path, and normalize-then-confine inside an allowed base directory.
What is CSRF (Cross-Site Request Forgery): an attack that makes a logged-in user send requests they did not intend
CSRF makes a logged-in user's browser send an unintended action, abusing the browser's habit of auto-attaching cookies. The main defense is CSRF tokens plus SameSite cookies. Never use GET for state changes.
What are SPF / DKIM / DMARC: three DNS settings that protect your domain from spoofed email
SPF/DKIM/DMARC are three DNS settings so receivers can verify your domain's mail. SPF = which servers may send, DKIM = a cryptographic signature, DMARC = the policy plus reports. Together they stop spoofing in your name. Ramp DMARC from p=n…
What is SQL injection (SQLi): a flaw that lets input rewrite your database commands
SQLi is when input is read as 'part of the command' rather than data, changing a query's meaning and leading directly to read/alter/delete. The main defense is to stop string-concatenating SQL and pass values via placeholders (prepared stat…
What is XSS (Cross-Site Scripting): a flaw that runs an attacker's script in another user's browser
XSS makes an attacker-supplied string run 'as script' in another user's browser, leading directly to session theft and impersonation. The main defense is escaping on output. Don't disable your framework's auto-escaping.
What is a CVE? How the shared vulnerability ID system works
A CVE is a globally shared ID for a vulnerability (e.g. CVE-2025-12345). CVE = the name, CVSS = severity, KEV = is it exploited. It's the anchor for monitoring. Track it with machines, not by hand.
What is CVSS? The vulnerability severity score and how it's calculated
CVSS rates severity 0.0–10.0. The score is computed from defined metrics (attack vector, complexity, privileges, user interaction, scope, CIA impact) through a public formula — not a guess. Know the rubric and you can read what a 10.0 means…
What is .env — what happens when an environment file leaks
.env holds an app's secrets (DB auth, API keys, encryption keys). Because the keys are gathered in one file, exposure leaks every secret at once. Keep the app outside the docroot, never commit it to git, and rotate everything if it leaks.
What is RCE (Remote Code Execution) — why it's the worst class of bug
RCE lets an attacker run arbitrary code on your server — straight to takeover, the worst class. How far the damage spreads is set by the running process's privileges. The core defenses are fast patching, CVE monitoring, and least privilege.
What is SSRF (Server-Side Request Forgery)
SSRF abuses external-input URLs to make a server access internal resources (internal IPs, cloud metadata). If you fetch URLs, you need an allowlist of destinations, internal-target blocking, and protection against redirect/DNS-rebinding byp…