Glossary
CVE, CVSS, RCE, SSRF, XSS, SPF/DKIM/DMARC — each term with a one-line answer and a plain explanation.
What is GDPR — the EU's data-protection rules and breach-notification duty
GDPR (General Data Protection Regulation) is the EU's comprehensive rulebook for protecting the personal data of people in the EU — and it can reach businesses outside the EU that serve EU users. It requires a lawful basis (e.g. consent), clear purpose, data minimization, data-subject rights (access/erasure), and breach notification to the authority (generally within 72 hours), with heavy fines for serious violations. The technical gist: collect and hold only the personal data you need, protect it, and be able to detect and report a breach quickly.
What is the OWASP Top 10 — the standard list of the 10 biggest web-app risks
The OWASP Top 10 is a list the non-profit OWASP publishes every few years of the 'most critical web-app risks.' It's a common language for developers and operators. The current edition (2021) is led by Broken Access Control, followed by injection, misconfiguration, vulnerable and outdated components, authentication failures, and more. These are risk CATEGORIES, not individual exploits — use them as a lens to audit your own app.
What is PCI DSS — the security standard for handling credit-card data
PCI DSS (Payment Card Industry Data Security Standard) is the international standard for businesses that store, process, or transmit card data. Set by the card brands, it requires network protection, encryption of stored data, least-privilege access control, monitoring/logging, and vulnerability management. In practice the safest move is to not hold card numbers yourself — hand processing to a compliant payment provider (tokenization) and shrink your scope.
What is public-key cryptography — encrypting and signing with a key pair
Public-key crypto uses a 'public key' (safe to hand out) and a 'private key' (held only by the owner). Anything encrypted with the public key can only be decrypted by the matching private key, and a signature made with the private key can be verified with the public key. That asymmetry underpins TLS (HTTPS) key exchange, digital signatures, and passkeys. Defenses: don't roll your own crypto (use standard protocols and battle-tested libraries), protect and be able to revoke the private key, and keep key length and algorithms current.
What is malware? Types, infection routes, and the basic defenses
Malware (malicious software) is the umbrella term for software built to harm your devices or data. Viruses, worms, trojans, ransomware, spyware, and bots are all types under it. However different they look, the defense is the same three layers: close the entry (updates, don't open suspicious attachments/macros, MFA), detect (EDR, antivirus), and be able to recover (backups). Mastering the principle matters far more than memorizing the type names.
What is a one-time password (OTP)? TOTP vs HOTP vs SMS, and its limits
A one-time password (OTP) is a short-lived, single-use code that becomes invalid once used. Types: authenticator-app TOTP (time-based), HOTP (counter-based), and SMS-OTP. It's strong against leaked and reused passwords and is commonly the 'something you have' factor in 2FA. But it has a limit: adversary-in-the-middle (AiTM) phishing can relay an OTP through a fake site and still get in. True phishing resistance comes from a domain-bound passkey. OTP is 'much better than nothing, but not the finish line.'
What is two-factor authentication (2FA)? vs two-step, and the strength of each method
Two-factor authentication (2FA) strengthens identity checks by adding a different category of proof — 'something you have' or 'something you are' (a code, key, or biometric) — on top of 'something you know' (your password). It is strictly not the same as two-step verification (two checks, not necessarily two categories). Strength depends on the method: SMS/email < authenticator app (TOTP) < passkey/security key (FIDO2). This site's stance: turn on some 2FA everywhere first, then move key accounts to methods you can't hand to a phishing site.
What is Let's Encrypt — the free CA that automates HTTPS
Let's Encrypt = a free, automated TLS certificate authority (CA). The ACME protocol verifies domain control automatically, so issuance and renewal are hands-off. Certificates are short-lived (90 days) by design — to shrink the window of a key compromise and force automation. The biggest real-world incident isn't an attack but a renewal that quietly broke → cert expired → browser warning → users bounce. So monitor expiry. This site itself uses Let's Encrypt via Caddy's automatic TLS.
What is OpenSSL — the library under HTTPS, and how to defend it
OpenSSL = the open-source library that powers HTTPS (TLS/SSL) and crypto. Most people never write it directly — they inherit it via the web server, OS, or language runtime. That's why one bug has an enormous blast radius (Heartbleed is the classic case). Defense: know which OpenSSL your stack uses, don't run EOL versions, include foundational libraries in CVE monitoring, and patch promptly. Even the certificates this site serves run crypto through an OpenSSL-family implementation underneath.
What is a passkey? Passwordless login with nothing to steal
A passkey is a login with no shared secret. Your device signs with a private key plus biometrics and the server stores only the matching public key. So a leak can't be abused, and the signature is bound to the domain — it won't complete on a fake site, making it structurally phishing-resistant. Safer than password + SMS code; migrate important accounts first.
What is password hashing? Storing passwords safely with a one-way transform
Password hashing means storing a password as a one-way, non-reversible transform. Never store plaintext. Unlike encryption you can't decrypt it back — that's the point. But plain MD5/SHA-256 falls to rainbow tables and brute force. The fix: a per-user salt plus a deliberately slow hash (bcrypt/Argon2/scrypt). Don't roll your own — use the standard function.
What is a salt? The per-user 'seasoning' added to a password hash
A salt is a random, per-user value added before hashing a password. The same password then stores differently for every user, which defeats precomputed rainbow tables and stops one cracking run from breaking many accounts. A salt is not secret — store it alongside the hash. bcrypt/Argon2 add one automatically.
What is phishing? The types of attack, and defenses surer than 'spotting it'
Phishing impersonates a trusted party to lure you to a fake login page and steal credentials or data (or run malware). It targets human judgment rather than a software flaw, and is the number-one entry route for ransomware and breaches. Modern adversary-in-the-middle (AiTM) phishing relays even one-time codes to the real site in real time, so SMS/app MFA can be defeated. The sure defense isn't 'spotting it' but mechanisms: domain-bound phishing-resistant MFA (passkeys/security keys), going to the official site directly instead of clicking links, and email authentication (SPF/DKIM/DMARC).
What is a JWT (JSON Web Token)? How the signed pass works and how to use it safely
A JWT is a tamper-proof 'pass' a server issues by signing it. It has three parts — header.payload.signature — and the server verifies the signature to confirm authenticity. Watch out for: (1) always verify the signature and pin the expected alg (reject alg:none); (2) anyone can read the contents, so put no secrets in it; (3) keep expiry short and have a revocation strategy. Decoding (reading) and verifying (checking authenticity) are different things.
What is ransomware? How it works, how it gets in, and how to avoid paying
Ransomware is malware that encrypts your files and demands payment to get them back. Modern attacks add double extortion — they steal data first and threaten to leak it, so decryption alone doesn't stop the breach. Main entry routes: phishing, weak/no-MFA VPN/RDP, and unpatched internet-facing flaws. The single most important defense is offline/immutable backups plus restore tests — being able to recover without paying. Also close the entry (MFA, patching) and limit blast radius (least privilege, segmentation).
What is BitLocker — Windows disk encryption that protects data on a lost or stolen device
BitLocker is Windows' built-in disk encryption. It protects data when the PC is off or the drive is removed, turning a theft or loss into ciphertext. The big pitfall is the recovery key — lose it and you lock yourself out. It does not protect a running, logged-in PC, so pair it with a strong login and auto-lock.
What is C2 (command and control) — the channel attackers use to control a device after a breach
C2 is the channel a compromised device uses to call back to an attacker's server (a beacon) to receive commands and exfiltrate data — the stage after a breach. The keys to spotting it are suspicious periodic outbound traffic and known-bad destinations. Defenses: egress filtering, DNS monitoring, IOC/IOA matching, least privilege. Confirming 'no resident C2' is a key part of breach investigation.
What is CORS — how it works, and what a misconfiguration exposes
CORS is how the browser controls whether another origin's JS can read your API responses. A misconfiguration — reflecting any Origin, or Access-Control-Allow-Origin:* with credentials — lets a third-party site read logged-in data. The real defense: an allowlist, don't blindly reflect Origin, default deny.
What is EDR — recording endpoint 'behavior' to detect and respond to attacks that slip through
EDR continuously records endpoint behavior, detects suspicious activity (IOA-style), and supports response (isolate, investigate). It catches fileless and living-off-the-land attacks that signature/IOC-based antivirus misses, via behavior and a timeline. Small teams often don't need full EDR — built-in OS protection plus logs plus the IOA mindset gets much of the value.
What is an IOA (Indicator of Attack) — spotting a breach by behavior, not traces
An IOA (Indicator of Attack) spots a breach by the behavior of an attack in progress (privilege escalation → lateral movement → exfiltration). It's the counterpart to the after-the-fact IOC. Attackers swap hashes and IPs instantly, but the technique (behavior) is hard to change — so IOAs last. Even small teams can approach it by watching for behavior that differs from normal.
What is an IOC (Indicator of Compromise) — traces that reveal a breach
An IOC (Indicator of Compromise) is a trace a breach leaves behind — known-bad file hashes, attacker IPs/domains, URLs, unusual processes. Its value is mechanically detecting/blocking known-bad. But it's a reactive clue attackers can swap cheaply, so IOC matching is a last-check, not a cure. The real defense is a design that doesn't burn (least privilege, patching, MFA).
What is session fixation — making a victim log in with an ID the attacker already knows
Session fixation makes a victim use an attacker-known session ID, then impersonates them after they log in with it. The real defense: regenerate the session ID on login (and on privilege change). Don't accept IDs from the URL, and harden cookies with HttpOnly/Secure/SameSite.
What is clickjacking — invisible traps that make you click hidden buttons
Clickjacking layers your real site invisibly over an attacker's page so the user performs an unintended action (transfer, settings change, consent). The real defense is refusing to be framed — CSP frame-ancestors plus X-Frame-Options.
What is IDOR — seeing someone else's data just by changing an ID
IDOR lets a user change ?id=124 to 125 and read someone else's invoice or personal data — broken access control. The real defense: server-side, check on every access whether the logged-in user is allowed this object. Hard-to-guess IDs are not a fix.
What is open redirect — your trusted URL used as a springboard to another site
An open redirect lets a ?next= style parameter forward users to any external site, borrowing your trusted domain for phishing. The real defense: never accept external URLs as redirect targets — relative paths and an allowlist only.
What is path traversal — reading files the server should never serve, via ../
Path traversal mixes ../ into a filename input to escape the base directory and read/write .env, config, or keys. The real defense: never use user input as a raw file path, and normalize-then-confine inside an allowed base directory.
What is CSRF (Cross-Site Request Forgery) — making a logged-in user act without meaning to
CSRF makes a logged-in user's browser send an unintended action, abusing the browser's habit of auto-attaching cookies. The real defense is CSRF tokens plus SameSite cookies. Never use GET for state changes.
What are SPF / DKIM / DMARC — the trio that protects your domain from spoofed email
SPF/DKIM/DMARC are three DNS settings so receivers can verify your domain's mail. SPF = which servers may send, DKIM = a cryptographic signature, DMARC = the policy plus reports. Together they stop spoofing in your name. Ramp DMARC from p=none upward.
What is SQL injection (SQLi) — when input rewrites your database's commands
SQLi is when input is read as 'part of the command' rather than data, changing a query's meaning — straight to read/alter/delete. The real defense is to stop string-concatenating SQL and pass values via placeholders (prepared statements).
What is XSS (Cross-Site Scripting) — code running in someone else's browser
XSS makes an attacker-supplied string run 'as script' in another user's browser — straight to session theft and impersonation. The real defense is escaping on output. Don't disable your framework's auto-escaping.
What is a CVE — the shared 'jersey number' for vulnerabilities
A CVE is a globally shared ID for a vulnerability (e.g. CVE-2025-12345). CVE = the name, CVSS = severity, KEV = is it exploited. It's the anchor for monitoring. Track it with machines, not by hand.
What is CVSS — the severity score and how it's actually scored
CVSS rates severity 0.0–10.0. The score is computed from defined metrics (attack vector, complexity, privileges, user interaction, scope, CIA impact) through a public formula — not a guess. Know the rubric and you can read what a 10.0 means. Still, prioritize with KEV (is it exploited) and whether you use it.
What is .env — what happens when an environment file leaks
.env holds an app's secrets (DB auth, API keys, encryption keys). Because the keys are gathered in one file, exposure leaks every secret at once. Keep the app outside the docroot, never commit it to git, and rotate everything if it leaks.
What is RCE (Remote Code Execution) — why it's the worst class of bug
RCE lets an attacker run arbitrary code on your server — straight to takeover, the worst class. The blast radius is set by the running process's privileges. The core defenses are fast patching, CVE monitoring, and least privilege.
What is SSRF (Server-Side Request Forgery)
SSRF abuses external-input URLs to make a server hit internal resources (internal IPs, cloud metadata). If you fetch URLs, you need an allowlist of destinations, internal-target blocking, and to close redirect/DNS-rebinding gaps. It was the entry point of the Capital One breach.