Before the Conversation
Before the foundation can be laid, there are the words. Every field has its language. Cybersecurity is no different. The concepts may be complex, but the first step toward understanding them is knowing what they mean and knowing how they connect.
"Before the Conversation" is my curated collection of the vocabulary I encounter across network security, cybersecurity, technology, and the disciplines that intersect with them. Some terms are foundational. Others lead into subjects I am still exploring. Some will become familiar; others may change meaning as the technology around them evolves. This is not intended to be a definitive dictionary. It is a living document a resource that will grow alongside my research, studies, and professional practice.
Before we examine the architecture, investigate the vulnerability, analyze the traffic, or explore what comes next in technology, we need a common language. These are the words before the conversation.
VOCABULARY
(AAA) Authentication, Authorization, Accounting
Authentication, Authorization, Accounting
The three-step security framework: proving who you are, determining what you can access, and tracking what you do.
The three-step security framework: proving who you are, determining what you can access, and tracking what you do.
(ABAC) Attribute-Based Access Control
Access decisions based on user attributes (department, time, location) rather than just roles.
(ACL) Access Control List
is a list of permissions associated with a system resource that specifies which users or
processes are granted access and what operations they can perform on that resource. ACLs are
commonly used in computer security to manage access to files, directories, and network
resources.
(AES) Advanced Encryption Standard
The gold standard for encrypting data so only authorized parties can read it.
(AD) Active Directory
Microsoft's directory service for managing users, computers, authentication, and permissions
across a network.
(AES-256) Advanced Encryption Standard 256-bit
A 256-bit version of AES that provides an extremely large keyspace, making brute-force attacks
computationally impractical with current technology.
(AH) Authentication Header
An IPsec protocol that provides authentication and integrity, helping prove that a packet came
from its expected source and was not altered in transit.
(AI) Artificial Intelligence
The field of creating systems capable of performing tasks that typically require human
intelligence, such as learning, reasoning, recognizing patterns, and making decisions.
(AIS) Automated Indicator Sharing
A system for automatically sharing cyber threat indicators between organizations so they can
identify and respond to known threats more quickly.
(ALE) Annualized Loss Expectancy
An estimate of the expected financial loss from a specific risk over the course of a year.
Algorithm
A defined set of rules or steps for solving a problem, processing information, or making a
decision()the instructions that tell a computer what to do with data.
(AP) Access Point
A device that provides wireless devices with access to a network, acting as a wireless doorway
into the network.
(API) Application Programming Interface
A defined way for software applications and systems to communicate with one another()the digital
handshake between systems.
(APT) Advanced Persistent Threat
A prolonged and targeted cyberattack in which an adversary gains access to a network and
attempts to remain undetected while pursuing a specific objective.
(ARO) Annualized Rate of Occurrence
The estimated number of times a specific risk or security incident is expected to occur within a
year.
(ARP) Address Resolution Protocol
A network protocol used to associate an IPv4 address with the MAC address of a device on the
local network.
(ASLR) Address Space Layout Randomization
A security technique that randomizes the memory locations of program components, making it more
difficult for attackers to reliably exploit memory-based vulnerabilities.
(ASP) Application Service Provider
A company that hosts and manages software applications and provides access to those applications
over a network for customers.
(ATT&CK) Adversarial Tactics, Techniques, and Common Knowledge
A knowledge base that documents how adversaries operate, including their tactics, techniques,
and procedures across different stages of an attack.
(AUP) Acceptable Use Policy
A policy that defines how an organization's technology, systems, networks, and data may and may
not be used.
(AV) Antivirus
Security software designed to detect, prevent, and remove malicious software from computers and
other systems.
(AEAD) Authenticated Encryption with Associated Data
An encryption method that provides both confidentiality and integrity, protecting encrypted data
from being read or altered without detection while also allowing additional authenticated data
to remain unencrypted.
(AS) Autonomous System
A collection of IP networks and routers operated by one organization or administrative entity
that follows a common routing policy.
(BASH) Bourne Again SHell
A command-line shell commonly used on Linux and other Unix-like systems for executing commands,
running scripts, and interacting directly with the operating system.
(BCP) Business Continuity Planning
The process of preparing an organization to maintain critical operations during and after
disasters, security incidents, or other disruptions.
(BGP) Border Gateway Protocol
The routing protocol used to exchange reachability information between autonomous systems,
helping determine how traffic travels between networks across the internet.
(BIA) Business Impact Analysis
The process of identifying critical business functions and determining how disruptions to those
functions would affect the organization.
Big Data
Extremely large, complex, or rapidly generated datasets that require specialized methods and
technologies to store, process, and analyze.
(BIOS) Basic Input/Output System
Firmware that initializes hardware and performs basic system checks when a computer starts
before handing control to the operating system.
(BPA) Business Partnership Agreement
An agreement between organizations that establishes the terms, responsibilities, and
expectations governing a business partnership.
(BPDU) Bridge Protocol Data Unit
Network messages exchanged by switches running Spanning Tree Protocol to identify network
topology and prevent switching loops.
(BSSID) Basic Service Set Identifier
The identifier for a wireless network's basic service set, typically represented by the MAC
address of the wireless access point.
(BYOD) Bring Your Own Device
A policy or practice that allows employees to use personally owned devices to access
organizational systems, networks, or data.
(BEC) Business Email Compromise
A social engineering attack in which an attacker compromises or impersonates a legitimate
business email account to deceive recipients into transferring money, revealing information, or
performing another unauthorized action.
(CBC) Cipher Block Chaining
A block cipher mode in which each plaintext block is combined with the previous ciphertext block
before encryption, linking the encrypted blocks together.
(CSP) Content Security Policy
A web security mechanism that allows a site to specify which sources of scripts, styles, images,
connections, and other resources a browser is permitted to load or execute.
(C2) Command and Control
The infrastructure or communication mechanism an attacker uses to remotely control compromised
systems, issue commands, or receive stolen information.
(CASB) Cloud Access Security Broker
A security control that sits between an organization and its cloud services to enforce security
policies, monitor activity, and protect cloud-based data.
(CBT) Computer-Based Training
Training delivered through computer-based software or digital platforms, often using interactive
lessons, simulations, exercises, or assessments.
(CCMP) Counter Mode with Cipher Block Chaining Message Authentication Code
Protocol
A wireless security protocol used by WPA2 that combines AES encryption in Counter Mode with
authentication and integrity protection using CBC-MAC.
(CFB) Cipher Feedback
A block cipher mode that allows a block cipher to operate like a stream cipher by using
previously encrypted data as feedback for subsequent encryption.
(CIA) Confidentiality, Integrity, Availability
The three foundational objectives of information security: protecting information from
unauthorized access, preventing unauthorized alteration, and ensuring systems and information
remain accessible when needed.
(CIO) Chief Information Officer
An executive responsible for an organization's information technology strategy, infrastructure,
systems, and technology operations.
(CIRT) Computer Incident Response Team
A team responsible for identifying, containing, investigating, and responding to cybersecurity
incidents.
(CN) Common Name
A field traditionally used in digital certificates to identify the subject, commonly
representing the domain name associated with the certificate.
(COBO) Corporate-Owned, Business Only
A device ownership model in which an organization provides and controls the device and restricts
its use to business purposes.
(COOP) Continuity of Operations Planning
Planning focused on maintaining an organization's essential functions during and after a
disruption or emergency.
(COPE) Corporate-Owned, Personally Enabled
A device ownership model in which an organization provides and manages the device while allowing
employees limited personal use.
(CRL) Certificate Revocation List
A digitally signed list maintained by a certificate authority identifying certificates that have
been revoked before their normal expiration date.
(CSF) Cybersecurity Framework
A structured framework for identifying, assessing, managing, and reducing cybersecurity risk
within an organization.
(CSO) Chief Security Officer
An executive responsible for an organization's overall security strategy, which may include
cybersecurity, physical security, personnel security, and risk management.
(CSP) Cloud Service Provider
A company that provides computing resources and services over a network, including
infrastructure, platforms, storage, databases, and software.
(CSR) Certificate Signing Request
A request submitted to a certificate authority when obtaining a digital certificate. It
typically contains the applicant's public key and identifying information.
(CSRF) Cross-Site Request Forgery
An attack that causes a user's authenticated browser to send an unintended request to a web
application, potentially performing an action without the user's knowledge.
(CTI) Cyber Threat Intelligence
The collection, analysis, and application of information about threats, threat actors,
vulnerabilities, and attack techniques to support security decisions.
(CTO) Chief Technology Officer
An executive responsible for an organization's technology strategy, innovation, and development,
often focusing on how technology can support future products and capabilities.
(CTR) Counter Mode
A block cipher mode that generates a stream of encrypted counter values, allowing plaintext
blocks to be encrypted independently and efficiently.
(CVE) Common Vulnerabilities and Exposures
A standardized system for identifying publicly known cybersecurity vulnerabilities, with each
vulnerability assigned a unique identifier.
(CYOD) Choose Your Own Device
A device management model in which employees choose from an organization-approved selection of
devices for work use.
(DAC) Discretionary Access Control
An access control model in which the owner or designated controller of a resource determines who
can access it and what permissions they receive.
Data Harvesting
The systematic collection of data from individuals, systems, applications, or other sources,
often for analysis, profiling, commercial use, or intelligence gathering.
(DDoS) Distributed Denial of Service
An attack that uses multiple systems to overwhelm a target with traffic or requests, making a
service slow, unavailable, or inaccessible to legitimate users.
(DHCP) Dynamic Host Configuration Protocol
A network protocol that automatically provides devices with configuration information such as IP
addresses, subnet masks, default gateways, and DNS servers.
Digital Footprint
The trail of information and activity created by your interactions with digital services,
devices, websites, applications, and networks.
(DNS) Domain Name System
The system that translates human-readable domain names, such as example.com, into IP addresses
that computers use to locate network resources.
(DNSSEC) DNS Security Extensions
A set of extensions that use digital signatures to authenticate DNS responses and help prevent
attackers from redirecting users to fraudulent destinations.
(EAP) Extensible Authentication Protocol
An authentication framework that supports multiple authentication methods and is commonly used
with enterprise wireless networks and network access control.
(ECC) Elliptic Curve Cryptography
A public-key cryptography approach based on the mathematics of elliptic curves that provides
strong security with comparatively small key sizes.
(FIM) File Integrity Monitoring
The process of monitoring important files and system components for unauthorized or unexpected
changes that could indicate tampering or compromise.
(FTP) File Transfer Protocol
A network protocol used to transfer files between systems. Standard FTP does not encrypt
credentials or data, making it unsuitable for sensitive transfers without additional protection.
(FTPS) FTP Secure
An extension of FTP that uses TLS to encrypt the connection and protect credentials and file
transfers from interception.
(GDPR) General Data Protection Regulation
A European Union regulation governing the collection, processing, storage, and protection of
personal data and establishing rights for individuals over their information.
(HTTPS) Hypertext Transfer Protocol Secure
HTTP communication protected by TLS, providing encryption, authentication, and integrity for
data exchanged between a browser and a web server.
(IaaS) Infrastructure as a Service
A cloud computing model that provides fundamental computing resources such as virtual machines,
storage, and networking infrastructure on demand.
(IDS) Intrusion Detection System
A security system that monitors network traffic or system activity for suspicious behavior and
generates alerts when potential threats are detected.
(IoT) Internet of Things
A collection of physical devices embedded with sensors, software, and network connectivity that
allows them to collect, exchange, and sometimes act on data.
(IPS) Intrusion Prevention System
A security system that monitors activity for malicious behavior and can automatically take
action to block, reject, or otherwise prevent detected threats.
(IV) Initialization Vector
A value used with certain encryption algorithms to introduce variation into the encryption
process so that identical plaintext does not necessarily produce identical ciphertext.
(JIT) Just-In-Time
A security approach in which access or privileges are granted only when needed and for the
minimum amount of time necessary.
(KDC) Key Distribution Center
A trusted system responsible for managing and distributing cryptographic keys, commonly used in
authentication systems such as Kerberos.
(LDAP) Lightweight Directory Access Protocol
A protocol used to access and manage directory information, commonly providing centralized
information about users, groups, devices, and other network resources.
(MAC) Mandatory Access Control
An access control model in which access decisions are enforced by centrally defined security
policies, labels, or classifications rather than by individual resource owners.
(MFA) Multi-Factor Authentication
An authentication method that requires two or more different factors to verify a user's
identity, such as something you know, something you have, or something you are.
(MITM) Man-in-the-Middle
An attack in which an adversary secretly intercepts and potentially alters communications
between two parties who believe they are communicating directly with each other.
(ML) Machine Learning
A branch of artificial intelligence in which systems learn patterns from data and use those
patterns to make predictions, classifications, or decisions without being explicitly programmed
for every scenario.
(NAC) Network Access Control
A security approach that evaluates users and devices before or during network access and can
enforce policies based on identity, device security, location, or other conditions.
(NAT) Network Address Translation
A networking technique that translates IP addresses, commonly allowing multiple devices using
private addresses to communicate with external networks through one or more public addresses.
(OSI) Open Systems Interconnection
A seven-layer conceptual model used to describe how network communication functions, from
physical transmission through application-level communication.
(OTP) One-Time Password
A password or authentication code that is valid for a single authentication attempt or
transaction and cannot normally be reused.
(PaaS) Platform as a Service
A cloud computing model that provides a managed platform for developing, running, and deploying
applications without requiring the customer to manage the underlying infrastructure.
(PKI) Public Key Infrastructure
The systems, technologies, policies, and processes used to create, manage, distribute, validate,
and revoke digital certificates and public-key credentials.
(PSK) Pre-Shared Key
A secret value that is established between communicating parties before it is used for
authentication or encryption.
(QoS) Quality of Service
Network techniques used to classify, prioritize, and manage traffic so that important
applications or communications receive the performance and resources they require.
(RA) Registration Authority
A component of a public key infrastructure that verifies the identity and information associated
with certificate requests before a certificate authority issues the certificate.
(RADIUS) Remote Authentication Dial-In User Service
A network authentication, authorization, and accounting protocol commonly used to control access
to network services such as Wi-Fi, VPNs, and network infrastructure.
(RBAC) Role-Based Access Control
An access control model in which permissions are assigned to roles and users receive access
based on the roles assigned to them.
(RDP) Remote Desktop Protocol
A Microsoft protocol that allows users to remotely connect to and interact with a graphical
desktop and applications on another computer.
(SaaS) Software as a Service
A cloud computing model in which software is hosted and maintained by a provider and accessed by
customers over a network rather than installed and managed locally.
(SAN) Subject Alternative Name
A field in a digital certificate that allows the certificate to identify multiple domain names,
IP addresses, or other identities.
(SDN) Software-Defined Networking
A networking architecture that separates network control from packet forwarding and uses
software-based controllers to centrally manage network behavior.
(SIEM) Security Information and Event Management
A security platform that collects, aggregates, and analyzes log and event data from multiple
sources to identify suspicious activity and support security investigations.
(SLA) Service Level Agreement
An agreement that defines expected service performance, availability, responsibilities, and
other measurable commitments between a service provider and customer.
(SMTP) Simple Mail Transfer Protocol
A protocol used to transmit and relay email messages between mail servers and, in some cases,
from email clients to mail servers.
(SQL) Structured Query Language
A language used to interact with relational databases, including retrieving, inserting,
modifying, and managing structured data.
(SSH) Secure Shell
A cryptographic network protocol used to securely access and administer remote systems, commonly
through a command-line interface.
(SSL) Secure Sockets Layer
An older cryptographic protocol originally used to secure network communications. SSL has been
deprecated and replaced by TLS, but the term remains common in technology and security
vocabulary.
Tech Stack
The collection of programming languages, frameworks, applications, platforms, services,
databases, and other technologies used to build and operate a system or organization.
(TLS) Transport Layer Security
A cryptographic protocol that provides encryption, authentication, and integrity for network
communications, including HTTPS web traffic.
(TOTP) Time-Based One-Time Password
An authentication code generated from a shared secret and the current time, typically producing
a new code at regular intervals for use as an authentication factor.
(UEFI) Unified Extensible Firmware Interface
The modern firmware interface that replaced traditional BIOS, providing hardware initialization,
boot management, and additional security and system-management capabilities.
(URL) Uniform Resource Locator
The address used to identify and locate a resource on a network, such as a webpage, file, or API
endpoint.
Vendor Lock-in
A situation in which switching from one technology provider to another becomes difficult,
costly, or impractical because of dependencies on a provider's products, services, data formats,
or infrastructure.
(VLAN) Virtual Local Area Network
A logical network segment created within a physical network that separates traffic and devices
as though they were on different networks.
(VPN) Virtual Private Network
A technology that creates an encrypted connection between a device or network and another
network over an underlying network such as the internet.
(WAF) Web Application Firewall
A security control designed to monitor and filter HTTP traffic to and from web applications,
helping detect and block attacks such as SQL injection and cross-site scripting.
(WEP) Wired Equivalent Privacy
An older wireless security protocol that uses flawed cryptographic mechanisms and is considered
insecure. WEP has been replaced by stronger standards such as WPA2 and WPA3.
(WPA) Wi-Fi Protected Access
A family of wireless security protocols designed to improve the security weaknesses of WEP by
providing stronger authentication and encryption.
(XSS) Cross-Site Scripting
A web application vulnerability in which an attacker causes malicious script to execute in
another user's browser, potentially allowing data theft, session compromise, or unauthorized
actions.
(ZTA) Zero Trust Architecture
A security architecture based on continuously verifying users, devices, and access requests
rather than automatically trusting entities because they are inside a network.
(ZAP) Zed Attack Proxy
An open-source web application security testing tool from OWASP that can be used to intercept,
inspect, and test web application traffic for vulnerabilities.
Zero Trust
A security approach based on the principle of "never trust, always verify," requiring access
requests to be evaluated rather than automatically trusted based on network location or previous
access.