Tech Glossary — Page 4

Forensic artifacts that signal a system may have been breached, such as unexpected files, unusual process restarts, known-malicious IP addresses, or file hashes. Responders use published IoCs to hunt for evidence of exploitation after a vulnerability is disclosed.

An access control list applied on network devices in front of infrastructure systems that permits only the specific management and control-plane traffic those systems need and drops everything else. Because it is enforced outside the protected appliance, it mitigates vulnerabilities in the appliance's own software until a patch is applied.

A ransomware technique that encrypts files in chunks with gaps between encrypted regions, dramatically increasing encryption speed while still rendering files unusable.

Network-connected devices beyond traditional computers—smart speakers, cameras, thermostats, etc.

A just-in-time compiler translates frequently executed code into native machine code at runtime, using assumptions gathered from earlier executions and guards that fall back to slower paths when an assumption fails. V8's Maglev and Turbofan tiers are JIT compilers; missing or weak guards are a leading source of browser zero-days.

A capability that lets running code inspect and invoke classes and methods by name at runtime rather than at compile time. In a script sandbox, reflection is a common escape path because it lets guest code locate dangerous host classes even when they are not directly exposed.

A shared secret that the services of a distributed application use to authenticate to each other when joining a deployment. If the software falls back to a predictable value when no key is set, attackers can forge service credentials — the flaw class behind the 2026 Artifactory authentication bypass.

A hardened, closely monitored system that serves as the single controlled entry point into a protected network segment. Administrators connect to it first with strong authentication, and all administrative sessions to sensitive infrastructure pass through it and are logged there.

CISA's catalog of vulnerabilities that are actively being exploited in the wild, requiring federal agencies to patch within specific timeframes.

A piece of kernel code (driver, filesystem, protocol or crypto component) that is loaded into a running Linux kernel on demand rather than compiled in. Blocking a vulnerable module from loading is a common stopgap mitigation until a patched kernel can be booted.

A Linux kernel feature that performs TLS record encryption and decryption inside the kernel after a userspace library completes the handshake, enabling zero-copy sends and NIC offload at the cost of running the record parser in ring 0.

A VPN feature that blocks all internet traffic if the VPN connection drops, preventing data leaks.

A reverse proxy that sits between applications and model providers, holding the real provider API keys, issuing virtual keys to applications, and enforcing budgets, routing and logging. It is a credential concentrator: compromising one gateway can expose every provider relationship an organization has.

The delay between sending a request and receiving a response, measured in milliseconds (ping).

Techniques attackers use to move through a network after initial compromise, seeking additional systems to control and data to steal.

A design principle that grants each user, role, or process only the permissions it needs to do its job and no more. Applied to session roles in a remote-access tool, least privilege means a role that never moves files should not carry file-transfer permission.

Older authentication protocols (POP, IMAP, SMTP AUTH, older Office clients) that don't support modern security features like MFA, making them prime targets for credential attacks.

An attack in which a low-privileged user substitutes a symbolic link, junction or hard link for a path a privileged process is about to use, so the privileged file operation acts on an attacker-chosen target. It is a common route from local code execution to SYSTEM.

Fine-grained privileges (such as CAP_NET_ADMIN for network configuration) that split the traditional all-or-nothing root power into separate units a process can hold. Container runtimes and network daemons are often granted individual capabilities that expose kernel attack surface.

Applying a security fix to running software on an appliance or server without a full upgrade or reboot, often delivered automatically by the vendor. It shortens the exposure window but typically covers only supported releases and does not replace the full fixed release.

An attack technique where adversaries use legitimate, pre-installed system tools (like PowerShell, WMI, or certutil) rather than custom malware, making detection more difficult.

A unique hardware identifier assigned to every network interface.

Techniques that circumvent multi-factor authentication protections, including token theft, real-time phishing proxies, MFA fatigue attacks, and OAuth abuse.

A company that operates IT infrastructure and security for many client organisations under contract, typically through shared RMM and remote-access tooling. That shared tooling concentrates privilege, so an MSP compromise can cascade into every client it manages.

An Active Directory account that represents a computer or service rather than a person. Machine accounts often hold broad privileges, which makes them high-value targets for relay attacks.

An umbrella term for threat groups and techniques that skim payment card data from compromised online checkout pages, typically by injecting malicious code into the storefront. It is a recurring monetisation path for e-commerce breaches and part of why storefronts are high-value targets.

The interfaces and services used to configure and administer a device, as distinct from the data plane that carries user traffic. On a remote-access appliance the management plane is the admin console; exposing it to the internet or to the user-facing portal is a common root cause of privileged compromise.

A new universal smart home standard backed by Apple, Google, and Amazon for cross-platform compatibility.

A network where devices connect to multiple nodes, extending coverage and providing redundancy.

Data about data—like email timestamps, file sizes, or location tags on photos.

Microsoft's subscription-based cloud productivity suite including Office applications, Exchange Online, SharePoint, and Teams.

Microsoft's cloud-based identity and access management service (formerly Azure Active Directory), providing authentication, SSO, and security features for Microsoft 365 and other applications.

Microsoft's cloud-based enterprise mobility management solution that provides MDM and MAM capabilities.

A WSL networking mode that mirrors the Windows host network configuration into the Linux environment, improving VPN compatibility and enabling IPv6 support.

A vulnerability class (CWE-862) where an application authenticates who a user is but fails to check whether they are permitted to perform an action. The user is legitimately in the system; the flaw is that a permission boundary inside it is not enforced.

A subset of MDM that focuses on controlling corporate data within specific applications rather than managing the entire device.

Software that enables IT administrators to secure, monitor, and manage mobile devices accessing corporate resources.

An open standard that lets a language model discover and invoke external tools exposed by an MCP server, over a local stdio transport or a remote Streamable HTTP transport. Because MCP tools are arbitrary code with their own credentials, an authentication flaw on an MCP endpoint grants access to every connected system.

Authentication requiring two or more verification factors—something you know, have, or are.

A hosting model in which many customers share one server, one kernel, and one file system, each as a separate low-privileged local user. Any local privilege escalation bug on the host can turn one compromised customer account into control of all of them.