Tech Glossary

An IEEE standard for port-based network access control. A device connecting to a switch port or wireless network must authenticate, usually via a RADIUS server, before the port forwards its traffic; the server's response can also assign a VLAN or access policy.

A symmetric encryption algorithm widely used for securing sensitive data; AES-256 is military-grade.

A Windows interface that allows applications and services to integrate with anti-malware products, enabling security software to scan scripts and memory content before execution.

A set of rules and protocols that allows different software applications to communicate with each other, enabling data exchange and functionality sharing between systems.

A sophisticated, long-term cyberattack campaign, typically by nation-state actors, that gains unauthorized access and remains undetected to steal data or conduct espionage.

A network protocol that maps IP addresses to MAC (hardware) addresses, enabling devices to communicate on local networks.

Abstract Syntax Notation One, a standard for describing structured data as tag-length-value elements. X.509 certificates are ASN.1 encoded, so every TLS and IPsec endpoint contains an ASN.1 decoder that runs on untrusted input, a frequent source of memory-safety bugs.

A credential issued by an authorization server that grants an application temporary access to specific resources on behalf of a user.

An attack where adversaries gain unauthorized access to a user's online account, typically through credential theft, social engineering, or token abuse.

A vulnerability that attackers are currently using in real-world attacks, requiring immediate patching regardless of severity score.

A defense that places code and data at unpredictable memory addresses each time a program runs, so an attacker cannot hardcode where to jump. Exploits defeat it with an information leak that reveals a real address at runtime.

The internal Windows mechanism that lets processes on the same machine exchange messages, used heavily by system services and sandboxed components. Memory-corruption bugs in ALPC, like CVE-2026-85880, can let sandboxed code escape and elevate to SYSTEM.

Techniques attackers use to hide or destroy evidence of intrusion, such as deleting or truncating log files, clearing event logs, or altering timestamps. Missing logs are themselves an indicator of compromise.

A Microsoft Defender for Cloud Apps feature that provides visibility into OAuth apps, detects anomalous behavior, and enables policy-based controls over third-party application access.

A Windows sandbox that runs code with a restricted token and limited access to files, network and other resources, used by browser renderers and Office protected view. Attackers chain a local privilege-escalation bug to break out of an AppContainer and reach SYSTEM.

An exploitation outcome where an attacker can retrieve any file the vulnerable application's process can open. On platforms that store configuration and encryption keys on disk, an arbitrary file read is often equivalent to full credential theft.

A flaw (CWE-88) in which attacker-controlled input is passed into a command or program as arguments without neutralizing delimiters, so a value such as a username beginning with a dash is interpreted as an option rather than data. In RouterOS this allowed privilege escalation via a crafted SSH username (CVE-2026-86060).

A server that stores and serves the binary outputs of software builds — packages, container images, libraries — plus the dependencies pulled into them. Because every deployment consumes its contents, administrative compromise of an artifact repository lets an attacker tamper with the software supply chain at scale.

The sum of all points where an unauthorized user could attempt to enter or extract data from a system: exposed services, interfaces, accounts, and integrations. Reducing attack surface means removing reachability, not just patching.

A set of configurable Microsoft Defender rules that block common malware behaviors, such as script interpreters launching downloaded executables or the execution of obfuscated scripts, adding behavioral guardrails independent of file signatures.

The CVSS base metric describing how far an attacker must be from the vulnerable component: Network, Adjacent, Local or Physical. It reflects the vendor's intended deployment, so an Adjacent-rated bug on an internet-exposed interface is effectively Network in practice.

A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials.

The most secure OAuth 2.0 flow where the client receives an authorization code that is exchanged for tokens via a back-channel server request.

A Microsoft service that automatically configures email client settings by querying DNS records to locate the Exchange server.

Microsoft's command-line interface for managing Azure resources and services, commonly used by developers and IT administrators for automation and deployment tasks.

CISA Binding Operational Directive 22-01, which requires U.S. Federal Civilian Executive Branch agencies to remediate vulnerabilities listed in the Known Exploited Vulnerabilities catalog by a set deadline. CISA shortens the deadline when exploitation is widespread.

CISA Binding Operational Directive 26-04, issued 10 June 2026, which replaced BOD 22-01. It assigns federal civilian agencies remediation deadlines of 3, 14, or 60 days based on asset exposure, KEV status, exploit automation, and post-exploitation impact, and requires forensic triage for the 3-day tier.

An API security vulnerability where applications fail to verify that users have permission to access specific data objects, allowing attackers to access unauthorized records by manipulating identifiers.

Software installed on a server that reads its files, databases, and mailboxes and copies them to a backup destination. Because it must read everything, it runs with the highest privileges on the host and holds credentials to backup storage, making it a high-value target.

A social engineering attack that uses a false promise or enticing offer to lure victims into a trap, such as leaving infected USB drives or offering free downloads.

Maximum data transfer rate of a network connection, measured in Mbps or Gbps.

A Git repository with no working tree; the repository root is itself the Git directory containing objects, refs, config, and hooks. Hosting servers use bare repositories, so a file written to a path like hooks/ inside one lands in Git's control plane rather than in project files.

A credential presented in an HTTP Authorization header that grants access to whoever holds it, with no proof of identity beyond possession. Services must validate the token on every request; a code path that accepts any bearer value, as in CVE-2026-59822, is an authentication bypass.

Using physical characteristics like fingerprints or facial recognition to verify identity.

The full set of systems, data, and access an attacker can reach after compromising a given asset. Ranking assets by blast radius rather than by how exposed they are pushes high-reach systems like a firewall management console to the top of the priority list.

A network of internet-connected devices compromised and controlled by an operator, used for denial-of-service attacks, proxying malicious traffic, credential stuffing or spam. Edge routers are prized botnet hosts because they are numerous, always on, directly reachable and rarely inspected by their owners.

A protocol that enables the transfer of cryptocurrency assets and data between different blockchain networks, often used to move funds across chains.

A policy allowing employees to use their personal devices to access corporate resources and applications.

An attack method that tries every possible password combination until finding the correct one.

A vulnerability where a program writes data beyond the boundaries of allocated memory, potentially overwriting adjacent memory and allowing attackers to execute malicious code.