Glossary

Cybersecurity

Terms and definitions from the certificate

A
Absolute file path: The full file path, which starts from the root

Access controls: Security controls that manage access, authorization, and

accountability of information

Active packet sniffing: A type of attack where data packets are manipulated in
transit

Address Resolution Protocol (ARP): A network protocol used to determine the MAC
address of the next router or device on the path

Advanced persistent threat (APT): An instance when a threat actor maintains

unauthorized access to a system for an extended period of time

Adversarial artificial intelligence (AI): A technique that manipulates artificial

intelligence (AI) and machine learning (ML) technology to conduct attacks more
efficiently

Adware: A type of legitimate software that is sometimes used to display digital

advertisements in applications

Algorithm: A set of rules used to solve a problem

Analysis: The investigation and validation of alerts

Angler phishing: A technique where attackers impersonate customer service

representatives on social media

Anomaly-based analysis: A detection method that identifies abnormal behavior

Antivirus software: A software program used to prevent, detect, and eliminate
malware and viruses

Application: A program that performs a specific task

Application programming interface (API) token: A small block of encrypted code

that contains information about a user

Argument (Linux): Specific information needed by a command

Argument (Python): The data brought into a function when it is called

Array: A data type that stores data in a comma-separated ordered list

Assess: The fifth step of the NIST RMF that means to determine if established controls
are implemented correctly

Asset: An item perceived as having value to an organization

Asset classification: The practice of labeling assets based on sensitivity and

importance to an organization

Asset inventory: A catalog of assets that need to be protected

Asset management: The process of tracking assets and the risks that affect them

Asymmetric encryption: The use of a public and private key pair for encryption and
decryption of data

Attack surface: All the potential vulnerabilities that a threat actor could exploit

Attack tree: A diagram that maps threats to assets

Attack vectors: The pathways attackers use to penetrate security defenses

Authentication: The process of verifying who someone is

Authorization: The concept of granting access to specific resources in a system

Authorize: The sixth step of the NIST RMF that refers to being accountable for the
security and privacy risks that might exist in an organization

Automation: The use of technology to reduce human and manual effort to perform
common and repetitive tasks

Availability: The idea that data is accessible to those who are authorized to access it
B
Baiting: A social engineering tactic that tempts people into compromising their
security

Bandwidth: The maximum data transmission capacity over a network, measured by

bits per second

Baseline configuration (baseline image): A documented set of specifications within

a system that is used as a basis for future builds, releases, and updates

Bash: The default shell in most Linux distributions

Basic auth: The technology used to establish a user’s request to access a server

Basic Input/Output System (BIOS): A microchip that contains loading instructions

for the computer and is prevalent in older systems

Biometrics: The unique physical characteristics that can be used to verify a person’s
identity

Bit: The smallest unit of data measurement on a computer

Boolean data: Data that can only be one of two values: either True or False

Bootloader: A software program that boots the operating system

Botnet: A collection of computers infected by malware that are under the control of a
single threat actor, known as the “bot-herder"

Bracket notation: The indices placed in square brackets

Broken chain of custody: Inconsistencies in the collection and logging of evidence in

the chain of custody

Brute force attack: The trial and error process of discovering private information

Bug bounty: Programs that encourage freelance hackers to find and report
vulnerabilities

Built-in function: A function that exists within Python and can be called directly
Business continuity: An organization's ability to maintain their everyday productivity
by establishing risk disaster recovery plans

Business continuity plan (BCP): A document that outlines the procedures to sustain
business operations during and after a significant disruption

Business Email Compromise (BEC): A type of phishing attack where a threat actor
impersonates a known source to obtain financial advantage

C
Categorize: The second step of the NIST RMF that is used to develop risk
management processes and tasks

CentOS: An open-source distribution that is closely related to Red Hat

Central Processing Unit (CPU): A computer’s main processor, which is used to

perform general computing tasks on a computer

Chain of custody: The process of documenting evidence possession and control

during an incident lifecycle

Chronicle: A cloud-native tool designed to retain, analyze, and search data

Cipher: An algorithm that encrypts information

Cloud-based firewalls: Software firewalls that are hosted by the cloud service
provider

Cloud computing: The practice of using remote servers, applications, and network
services that are hosted on the internet instead of on local physical devices

Cloud network: A collection of servers or computers that stores resources and data
in remote data centers that can be accessed via the internet

Cloud security: The process of ensuring that assets stored in the cloud are properly
configured and access to those assets is limited to authorized users

Command: An instruction telling the computer to do something

Command and control (C2): The techniques used by malicious actors to maintain
communications with compromised systems
Command-line interface (CLI): A text-based user interface that uses commands to
interact with the computer

Comment: A note programmers make about the intention behind their code

Common Event Format (CEF): A log format that uses key-value pairs to structure
data and identify fields and their corresponding values

Common Vulnerabilities and Exposures (CVE®) list: An openly accessible dictionary

of known vulnerabilities and exposures

Common Vulnerability Scoring System (CVSS): A measurement system that scores

the severity of a vulnerability

Compliance: The process of adhering to internal standards and external regulations

Computer security incident response teams (CSIRT): A specialized group of

security professionals that are trained in incident management and response

Computer virus: Malicious code written to interfere with computer operations and
cause damage to data and software

Conditional statement: A statement that evaluates code to determine if it meets a

specified set of conditions

Confidentiality: The idea that only authorized users can access specific assets or
data

Confidential data: Data that often has limits on the number of people who have
access to it

Confidentiality, integrity, availability (CIA) triad: A model that helps inform how
organizations consider risk when setting up systems and security policies

Configuration file: A file used to configure the settings of an application

Containment: The act of limiting and preventing additional damage caused by an

incident

Controlled zone: A subnet that protects the internal network from the uncontrolled
zone
Cross-site scripting (XSS): An injection attack that inserts code into a vulnerable
website or web application

Crowdsourcing: The practice of gathering information using public input and

collaboration

Cryptographic attack: An attack that affects secure forms of communication

between a sender and intended recipient

Cryptographic key: A mechanism that decrypts ciphertext

Cryptography: The process of transforming information into a form that unintended

readers can’t understand

Cryptojacking: A form of malware that installs software to illegally mine

cryptocurrencies

CVE Numbering Authority (CNA): An organization that volunteers to analyze and

distribute information on eligible CVEs

Cybersecurity (or security): The practice of ensuring confidentiality, integrity, and

availability of information by protecting networks, devices, people, and data from
unauthorized access or criminal exploitation

D
Data: Information that is translated, processed, or stored by a computer

Data at rest: Data not currently being accessed

Database: An organized collection of information or data

Data controller: A person that determines the procedure and purpose for processing
data

Data custodian: Anyone or anything that’s responsible for the safe handling,
transport, and storage of information

Data exfiltration: Unauthorized transmission of data from a system

Data in transit: Data traveling from one point to another

Data in use: Data being accessed by one or more users

Data owner: The person who decides who can access, edit, use, or destroy their
information

Data packet: A basic unit of information that travels from one device to another
within a network

Data point: A specific piece of information

Data processor: A person that is responsible for processing data on behalf of the
data controller

Data protection officer (DPO): An individual that is responsible for monitoring the
compliance of an organization's data protection procedures

Data type: A category for a particular type of data item

Date and time data: Data representing a date and/or time

Debugger: A software tool that helps to locate the source of an error and assess its
causes

Debugging: The practice of identifying and fixing errors in code

Defense in depth: A layered approach to vulnerability management that reduces risk

Denial of service (DoS) attack: An attack that targets a network or server and floods
it with network traffic

Detect: A NIST core function related to identifying potential security incidents and
improving monitoring capabilities to increase the speed and efficiency of detections

Detection: The prompt discovery of security events

Dictionary data: Data that consists of one or more key-value pairs

Digital certificate: A file that verifies the identity of a public key holder

Digital forensics: The practice of collecting and analyzing data to determine what has
happened after an attack

Directory: A file that organizes where other files are stored

Disaster recovery plan: A plan that allows an organization’s security team to outline
the steps needed to minimize the impact of a security incident
Distributed denial of service (DDoS) attack: A type of denial or service attack that
uses multiple devices or servers located in different locations to flood the target
network with unwanted traffic

Distributions: The different versions of Linux

Documentation: Any form of recorded content that is used for a specific purpose

DOM-based XSS attack: An instance when malicious script exists in the webpage a
browser loads

Domain Name System (DNS): A networking protocol that translates internet domain
names into IP addresses

Dropper: A program or a file used to install a rootkit on a target computer

E
Elevator pitch: A brief summary of your experience, skills, and background

Encapsulation: A process performed by a VPN service that protects your data by

wrapping sensitive data in other data packets

Encryption: The process of converting data from a readable format to an encoded

format

Endpoint: Any device connected on a network

Endpoint detection and response (EDR): An application that monitors an endpoint

for malicious activity

Eradication: The complete removal of the incident elements from all affected
systems

Escalation policy: A set of actions that outline who should be notified when an
incident alert occurs and how that incident should be handled

Event: An observable occurrence on a network, system, or device

Exception: An error that involves code that cannot be executed even though it is
syntactically correct
Exclusive operator: An operator that does not include the value of comparison

Exploit: A way of taking advantage of a vulnerability

Exposure: A mistake that can be exploited by a threat

External threat: Anything outside the organization that has the potential to harm
organizational assets

F
False negative: A state where the presence of a threat is not detected

False positive: An alert that incorrectly detects the presence of a threat

Fileless malware: Malware that does not need to be installed by the user because it
uses legitimate programs that are already installed to infect a computer

File path: The location of a file or directory

Filesystem Hierarchy Standard (FHS): The component of the Linux OS that

organizes data

Filtering: Selecting data that match a certain condition

Final report: Documentation that provides a comprehensive review of an incident

Firewall: A network security device that monitors traffic to or from a network

Float data: Data consisting of a number with a decimal point

Foreign key: A column in a table that is a primary key in another table

Forward proxy server: A server that regulates and restricts a person’s access to the
internet

Function: A section of code that can be reused in a program

G
Global variable: A variable that is available through the entire program
Graphical user interface (GUI): A user interface that uses icons on the screen to
manage different tasks on the computer

H
Hacker: Any person or group who uses computers to gain unauthorized access to
data

Hacktivist: A person who uses hacking to achieve a political goal

Hard drive: A hardware component used for long-term memory

Hardware: The physical components of a computer

Hash collision: An instance when different inputs produce the same hash value

Hash function: An algorithm that produces a code that can’t be decrypted

Hash table: A data structure that's used to store and reference hash values

Health Insurance Portability and Accountability Act (HIPAA): A U.S. federal law
established to protect patients’ health information

Honeypot: A system or resource created as a decoy vulnerable to attacks with the

purpose of attracting potential intruders

Host-based intrusion detection system (HIDS): An application that monitors the

activity of the host on which it’s installed

Hub: A network device that broadcasts information to every device on the network

Hypertext Transfer Protocol (HTTP): An application layer protocol that provides a

method of communication between clients and website servers

Hypertext Transfer Protocol Secure (HTTPS): A network protocol that provides a

secure method of communication between clients and website servers

I
Identify: A NIST core function related to management of cybersecurity risk and its
effect on an organization’s people and assets
Identity and access management (IAM): A collection of processes and technologies
that helps organizations manage digital identities in their environment

IEEE 802.11 (Wi-Fi): A set of standards that define communication for wireless LANs

Immutable: An object that cannot be changed after it is created and assigned a value

Implement: The fourth step of the NIST RMF that means to implement security and
privacy plans for an organization

Improper usage: An incident type that occurs when an employee of an organization

violates the organization’s acceptable use policies

Incident: An occurrence that actually or imminently jeopardizes, without lawful

authority, the confidentiality, integrity, or availability of information or an information
system; or constitutes a violation or imminent threat of violation of law, security
policies, security procedures, or acceptable use policies

Incident escalation: The process of identifying a potential security incident, triaging

it, and handing it off to a more experienced team member

Incident handler’s journal: A form of documentation used in incident response

Incident response: An organization’s quick attempt to identify an attack, contain the

damage, and correct the effects of a security breach

Incident response plan: A document that outlines the procedures to take in each
step of incident response

Inclusive operator: An operator that includes the value of comparison

Indentation: Space added at the beginning of a line of code

Index: A number assigned to every element in a sequence that indicates its position

Indicators of attack (IoA): The series of observed events that indicate a real-time
incident

Indicators of compromise (IoC): Observable evidence that suggests signs of a

potential security incident

Information privacy: The protection of unauthorized access and distribution of data

Information security (InfoSec): The practice of keeping data in all states away from
unauthorized users

Injection attack: Malicious code inserted into a vulnerable application

Input validation: Programming that validates inputs from users and other programs

Integer data: Data consisting of a number that does not include a decimal point

Integrated development environment (IDE): A software application for writing code

that provides editing assistance and error correction tools

Integrity: The idea that the data is correct, authentic, and reliable

Internal hardware: The components required to run the computer

Internal threat: A current or former employee, external vendor, or trusted partner

who poses a security risk

Internet Control Message Protocol (ICMP): An internet protocol used by devices to

tell each other about data transmission errors across the network

Internet Control Message Protocol flood (ICMP flood): A type of DoS attack
performed by an attacker repeatedly sending ICMP request packets to a network
server

Internet Protocol (IP): A set of standards used for routing and addressing data
packets as they travel between devices on a network

Internet Protocol (IP) address: A unique string of characters that identifies the
location of a device on the internet

Interpreter: A computer program that translates Python code into runnable

instructions line by line

Intrusion detection system (IDS): An application that monitors system activity and
alerts on possible intrusions

Intrusion prevention system (IPS): An application that monitors system activity for
intrusive activity and takes action to stop the activity

IP spoofing: A network attack performed when an attacker changes the source IP of a

data packet to impersonate an authorized system and gain access to a network
Iterative statement: Code that repeatedly executes a set of instructions

K
KALI LINUX ™: An open-source distribution of Linux that is widely used in the security
industry

Kernel: The component of the Linux OS that manages processes and memory

Key-value pair: A set of data that represents two linked items: a key, and its
corresponding value

L
Legacy operating system: An operating system that is outdated but still being used

Lessons learned meeting: A meeting that includes all involved parties after a major
incident

Library: A collection of modules that provide code users can access in their programs

Linux: An open-source operating system

List concatenation: The concept of combining two lists into one by placing the
elements of the second list directly after the elements of the first list

List data: Data structure that consists of a collection of data in sequential form

Loader: Malicious code that launches after a user initiates a dropper program

Local Area Network (LAN): A network that spans small areas like an office building, a
school, or a home

Local variable: A variable assigned within a function

Log: A record of events that occur within an organization’s systems

Log analysis: The process of examining logs to identify events of interest

Logging: The recording of events occurring on computer systems and networks

Logic error: An error that results when the logic used in code produces unintended
results
Log management: The process of collecting, storing, analyzing, and disposing of log
data

Loop condition: The part of a loop that determines when the loop terminates

Loop variable: A variable that is used to control the iterations of a loop

M
Malware: Software designed to harm devices or networks

Malware infection: An incident type that occurs when malicious software designed to
disrupt a system infiltrates an organization’s computers or network

Media Access Control (MAC) address: A unique alphanumeric identifier that is

assigned to each physical device on a network

Method: A function that belongs to a specific data type

Metrics: Key technical attributes such as response time, availability, and failure rate,
which are used to assess the performance of a software application

MITRE: A collection of non-profit research and development centers

Modem: A device that connects your router to the internet and brings internet access
to the LAN

Module: A Python file that contains additional functions, variables, classes, and any
kind of runnable code

Monitor: The seventh step of the NIST RMF that means be aware of how systems are
operating

Multi-factor authentication (MFA): A security measure that requires a user to verify

their identity in two or more ways to access a system or network

N
nano: A command-line file editor that is available by default in many Linux
distributions

National Institute of Standards and Technology (NIST) Cybersecurity Framework

(CSF): A voluntary framework that consists of standards, guidelines, and best
practices to manage cybersecurity risk
National Institute of Standards and Technology (NIST) Incident Response
Lifecycle: A framework for incident response consisting of four phases: Preparation;
Detection and Analysis; Containment, Eradication and Recovery, and Post-incident
activity

National Institute of Standards and Technology (NIST) Special Publication (S.P.)

800-53: A unified framework for protecting the security of information systems
within the U.S. federal government

Network: A group of connected devices

Network-based intrusion detection system (NIDS): An application that collects and

monitors network traffic and network data

Network data: The data that’s transmitted between devices on a network

Network Interface Card (NIC): Hardware that connects computers to a network

Network log analysis: The process of examining network logs to identify events of
interest

Network protocol analyzer (packet sniffer): A tool designed to capture and analyze
data traffic within a network

Network protocols: A set of rules used by two or more devices on a network to

describe the order of delivery and the structure of data

Network security: The practice of keeping an organization's network infrastructure

secure from unauthorized access

Network segmentation: A security technique that divides the network into segments

Network traffic: The amount of data that moves across a network

Non-repudiation: The concept that the authenticity of information can’t be denied

Notebook: An online interface for writing, storing, and running code

Numeric data: Data consisting of numbers

O
OAuth: An open-standard authorization protocol that shares designated access
between applications

Object: A data type that stores data in a comma-separated list of key-value pairs

On-path attack: An attack where a malicious actor places themselves in the middle of
an authorized connection and intercepts or alters the data in transit

Open-source intelligence (OSINT): The collection and analysis of information from

publicly available sources to generate usable intelligence

Open systems interconnection (OSI) model: A standardized concept that describes

the seven layers computers use to communicate and send data over the network

Open Web Application Security Project (OWASP): A non-profit organization

focused on improving software security

Operating system (OS): The interface between computer hardware and the user

Operator: A symbol or keyword that represents an operation

Options: Input that modifies the behavior of a command

Order of volatility: A sequence outlining the order of data that must be preserved
from first to last

OWASP Top 10: A globally recognized standard awareness document that lists the
top 10 most critical security risks to web applications

P
Package: A piece of software that can be combined with other packages to form an
application

Package manager: A tool that helps users install, manage, and remove packages or
applications

Packet capture (P-cap): A file containing data packets intercepted from an interface
or network

Packet sniffing: The practice of capturing and inspecting data packets across a
network
Parameter (Python): An object that is included in a function definition for use in that
function

Parrot: An open-source distribution that is commonly used for security

Parsing: The process of converting data into a more readable format

Passive packet sniffing: A type of attack where a malicious actor connects to a

network hub and looks at all traffic on the network

Password attack: An attempt to access password secured devices, systems,

networks, or data

Patch update: A software and operating system update that addresses security
vulnerabilities within a program or product

Payment Card Industry Data Security Standards (PCI DSS): Any cardholder data
that an organization accepts, transmits, or stores

Penetration test (pen test): A simulated attack that helps identify vulnerabilities in
systems, networks, websites, applications, and processes

PEP 8 style guide: A resource that provides stylistic guidelines for programmers
working in Python

Peripheral devices: Hardware components that are attached and controlled by the
computer system

Permissions: The type of access granted for a file or directory

Personally identifiable information (PII): Any information used to infer an

individual's identity

Phishing: The use of digital communications to trick people into revealing sensitive
data or deploying malicious software

Phishing kit: A collection of software tools needed to launch a phishing campaign

Physical attack: A security incident that affects not only digital but also physical
environments where the incident is deployed

Physical social engineering: An attack in which a threat actor impersonates an

employee, customer, or vendor to obtain unauthorized access to a physical location
Ping of death: A type of DoS attack caused when a hacker pings a system by sending
it an oversized ICMP packet that is bigger than 64KB

Playbook: A manual that provides details about any operational action

Policy: A set of rules that reduce risk and protect information

Port: A software-based location that organizes the sending and receiving of data
between devices on a network

Port filtering: A firewall function that blocks or allows certain port numbers to limit
unwanted communication

Post-incident activity: The process of reviewing an incident to identify areas for

improvement during incident handling

Potentially unwanted application (PUA): A type of unwanted software that is

bundled in with legitimate programs which might display ads, cause device slowdown,
or install other software

Private data: Information that should be kept from the public

Prepare: The first step of the NIST RMF related to activities that are necessary to
manage security and privacy risks before a breach occurs

Prepared statement: A coding technique that executes SQL statements before

passing them on to a database

Primary key: A column where every row has a unique entry

Principle of least privilege: The concept of granting only the minimal access and
authorization required to complete a task or function

Privacy protection: The act of safeguarding personal information from unauthorized

use

Procedures: Step-by-step instructions to perform a specific security task

Process of Attack Simulation and Threat Analysis (PASTA): A popular threat

modeling framework that’s used across many industries

Programming: A process that can be used to create a specific set of instructions for
a computer to execute tasks
Protect: A NIST core function used to protect an organization through the
implementation of policies, procedures, training, and tools that help mitigate
cybersecurity threats

Protected health information (PHI): Information that relates to the past, present, or
future physical or mental health or condition of an individual

Protecting and preserving evidence: The process of properly working with fragile
and volatile digital evidence

Proxy server: A server that fulfills the requests of its clients by forwarding them to
other servers

Public data: Data that is already accessible to the public and poses a minimal risk to
the organization if viewed or shared by others

Public key infrastructure (PKI): An encryption framework that secures the exchange
of online information

Python Standard Library: An extensive collection of Python code that often comes
packaged with Python

Q
Query: A request for data from a database table or a combination of tables

Quid pro quo: A type of baiting used to trick someone into believing that they’ll be
rewarded in return for sharing access, information, or money

R
Rainbow table: A file of pre-generated hash values and their associated plaintext

Random Access Memory (RAM): A hardware component used for short-term

memory

Ransomware: A malicious attack where threat actors encrypt an organization’s data

and demand payment to restore access

Rapport: A friendly relationship in which the people involved understand each other’s
ideas and communicate well with each other
Recover: A NIST core function related to returning affected systems back to normal
operation

Recovery: The process of returning affected systems back to normal operations

Red Hat® Enterprise Linux® (also referred to simply as Red Hat in this course): A
subscription-based distribution of Linux built for enterprise use

Reflected XSS attack: An instance when malicious script is sent to a server and
activated during the server’s response

Regular expression (regex): A sequence of characters that forms a pattern

Regulations: Rules set by a government or other authority to control the way

something is done

Relational database: A structured database containing tables that are related to each
other

Relative file path: A file path that starts from the user's current directory

Replay attack: A network attack performed when a malicious actor intercepts a data
packet in transit and delays it or repeats it at another time

Resiliency: The ability to prepare for, respond to, and recover from disruptions

Respond: A NIST core function related to making sure that the proper procedures are
used to contain, neutralize, and analyze security incidents, and implement
improvements to the security process

Return statement: A Python statement that executes inside a function and sends
information back to the function call

Reverse proxy server: A server that regulates and restricts the internet's access to
an internal server

Risk: Anything that can impact the confidentiality, integrity, or availability of an asset

Risk mitigation: The process of having the right procedures and rules in place to
quickly reduce the impact of a risk like a breach

Root directory: The highest-level directory in Linux

Rootkit: Malware that provides remote, administrative access to a computer

Root user (or superuser): A user with elevated privileges to modify the system

Router: A network device that connects multiple networks together

S
Salting: An additional safeguard that’s used to strengthen hash functions

Scareware: Malware that employs tactics to frighten users into infecting their device

Search Processing Language (SPL): Splunk’s query language

Secure File Transfer Protocol (SFTP): A secure protocol used to transfer files from
one device to another over a network

Secure shell (SSH): A security protocol used to create a shell with a remote system

Security architecture: A type of security design composed of multiple components,

such as tools and processes, that are used to protect an organization from risks and
external threats

Security audit: A review of an organization's security controls, policies, and

procedures against a set of expectations

Security controls: Safeguards designed to reduce specific security risks

Security ethics: Guidelines for making appropriate decisions as a security

professional

Security frameworks: Guidelines used for building plans to help mitigate risk and
threats to data and privacy

Security governance: Practices that help support, define, and direct security efforts
of an organization

Security hardening: The process of strengthening a system to reduce its

vulnerabilities and attack surface

Security information and event management (SIEM): An application that collects

and analyzes log data to monitor critical activities in an organization

Security mindset: The ability to evaluate risk and constantly seek out and identify the
potential or actual breach of a system, application, or data
Security operations center (SOC): An organizational unit dedicated to monitoring
networks, systems, and devices for security threats or attacks

Security orchestration, automation, and response (SOAR): A collection of

applications, tools, and workflows that use automation to respond to security events

Security posture: An organization’s ability to manage its defense of critical assets

and data and react to change

Security zone: A segment of a company’s network that protects the internal network
from the internet

Select: The third step of the NIST RMF that means to choose, customize, and capture
documentation of the controls that protect an organization

Sensitive data: A type of data that includes personally identifiable information (PII),
sensitive personally identifiable information (SPII), or protected health information
(PHI)

Sensitive personally identifiable information (SPII): A specific type of PII that falls
under stricter handling guidelines

Separation of duties: The principle that users should not be given levels of
authorization that would allow them to misuse a system

Session: a sequence of network HTTP requests and responses associated with the
same user

Session cookie: A token that websites use to validate a session and determine how
long that session should last

Session hijacking: An event when attackers obtain a legitimate user’s session ID

Session ID: A unique token that identifies a user and their device while accessing a
system

Set data: Data that consists of an unordered collection of unique values

Shared responsibility: The idea that all individuals within an organization take an
active role in lowering risk and maintaining both physical and virtual security

Shell: The command-line interpreter

Signature: A pattern that is associated with malicious activity

Signature analysis: A detection method used to find events of interest

Simple Network Management Protocol (SNMP): A network protocol used for

monitoring and managing devices on a network

Single sign-on (SSO): A technology that combines several different logins into one

Smishing: The use of text messages to trick users to obtain sensitive information or to
impersonate a known source

Smurf attack: A network attack performed when an attacker sniffs an authorized

user’s IP address and floods it with ICMP packets

Social engineering: A manipulation technique that exploits human error to gain

private information, access, or valuables

Social media phishing: A type of attack where a threat actor collects detailed
information about their target on social media sites before initiating the attack

Spear phishing: A malicious email attack targeting a specific user or group of users,
appearing to originate from a trusted source

Speed: The rate at which a device sends and receives data, measured by bits per
second

Splunk Cloud: A cloud-hosted tool used to collect, search, and monitor log data

Splunk Enterprise: A self-hosted tool used to retain, analyze, and search an

organization's log data to provide security information and alerts in real-time

Spyware: Malware that’s used to gather and sell information without consent

SQL (Structured Query Language): A programming language used to create,

interact with, and request information from a database

SQL injection: An attack that executes unexpected queries on a database

Stakeholder: An individual or group that has an interest in any decision or activity of

an organization

Standard error: An error message returned by the OS through the shell

Standard input: Information received by the OS via the command line

Standard output: Information returned by the OS through the shell

Standards: References that inform how to set policies

STAR method: An interview technique used to answer behavioral and situational

questions

Stateful: A class of firewall that keeps track of information passing through it and
proactively filters out threats

Stateless: A class of firewall that operates based on predefined rules and that does
not keep track of information from data packets

Stored XSS attack: An instance when malicious script is injected directly on the
server

String concatenation: The process of joining two strings together

String data: Data consisting of an ordered sequence of characters

Style guide: A manual that informs the writing, formatting, and design of documents

Subnetting: The subdivision of a network into logical groups called subnets

Substring: A continuous sequence of characters within a string

Sudo: A command that temporarily grants elevated permissions to specific users

Supply-chain attack: An attack that targets systems, applications, hardware, and/or

software to locate a vulnerability where malware can be deployed

Suricata: An open-source intrusion detection system, intrusion prevention system,

and network analysis tool

Switch: A device that makes connections between specific devices on a network by

sending and receiving data between them

Symmetric encryption: The use of a single secret key to exchange information

Synchronize (SYN) flood attack: A type of DoS attack that simulates a TCP/IP
connection and floods a server with SYN packets

Syntax: The rules that determine what is correctly structured in a computing language

Syntax error: An error that involves invalid usage of a programming language

T
Tailgating: A social engineering tactic in which unauthorized people follow an
authorized person into a restricted area

TCP/IP model: A framework used to visualize how data is organized and transmitted
across a network

tcpdump: A command-line network protocol analyzer

Technical skills: Skills that require knowledge of specific tools, procedures, and
policies

Telemetry: The collection and transmission of data for analysis

Threat: Any circumstance or event that can negatively impact assets

Threat actor: Any person or group who presents a security risk

Threat hunting: The proactive search for threats on a network

Threat intelligence: Evidence-based threat information that provides context about

existing or emerging threats

Threat modeling: The process of identifying assets, their vulnerabilities, and how
each is exposed to threats

Transferable skills: Skills from other areas that can apply to different careers

Transmission Control Protocol (TCP): An internet communication protocol that

allows two devices to form a connection and stream data

Triage: The prioritizing of incidents according to their level of importance or urgency

Trojan horse: Malware that looks like a legitimate file or program

True negative: A state where there is no detection of malicious activity

True positive An alert that correctly detects the presence of an attack

Tuple data: Data that consists of a collection of data that cannot be changed

Type error: An error that results from using the wrong data type

U
Ubuntu: An open-source, user-friendly distribution that is widely used in security and
other industries

Unauthorized access: An incident type that occurs when an individual gains digital or
physical access to a system or application without permission

Uncontrolled zone: Any network outside your organization's control

Unified Extensible Firmware Interface (UEFI): A microchip that contains loading

instructions for the computer and replaces BIOS on more modern systems

USB baiting: An attack in which a threat actor strategically leaves a malware USB stick
for an employee to find and install to unknowingly infect a network

User: The person interacting with a computer

User Datagram Protocol (UDP): A connectionless protocol that does not establish a
connection between devices before transmissions

User-defined function: A function that programmers design for their specific needs

User interface: A program that allows the user to control the functions of the
operating system

User provisioning: The process of creating and maintaining a user's digital identity

V
Variable: A container that stores data

Virtual Private Network (VPN): A network security service that changes your public
IP address and hides your virtual location so that you can keep your data private when
you are using a public network like the internet

Virus: Malicious code written to interfere with computer operations and cause
damage to data and software

VirusTotal: A service that allows anyone to analyze suspicious files, domains, URLs,
and IP addresses for malicious content

Vishing: The exploitation of electronic voice communication to obtain sensitive

information or to impersonate a known source
Visual dashboard: A way of displaying various types of data quickly in one place

Vulnerability: A weakness that can be exploited by a threat

Vulnerability assessment: The internal review process of an organization's security

systems

Vulnerability management: The process of finding and patching vulnerabilities

Vulnerability scanner: Software that automatically compares existing common

vulnerabilities and exposures against the technologies on the network

W
Watering hole attack: A type of attack when a threat actor compromises a website
frequently visited by a specific group of users

Web-based exploits: Malicious code or behavior that’s used to take advantage of

coding flaws in a web application

Whaling: A category of spear phishing attempts that are aimed at high-ranking

executives in an organization

Wide Area Network (WAN): A network that spans a large geographic area like a city,
state, or country

Wi-Fi Protected Access (WPA): A wireless security protocol for devices to connect
to the internet

Wildcard: A special character that can be substituted with any other character

Wireshark: An open-source network protocol analyzer

World-writable file: A file that can be altered by anyone in the world

Worm: Malware that can duplicate and spread itself across systems on its own

Y
YARA-L: A computer language used to create rules for searching through ingested
log data

Z
Zero-day: An exploit that was previously unknown