Tech Glossary — Page 5

A cryptocurrency wallet that requires multiple private key signatures to authorize transactions, providing enhanced security by eliminating single points of failure.

A WordPress plugin placed in the wp-content/mu-plugins directory, which loads automatically before normal plugins, cannot be deactivated from the admin interface, shows only under a separate Must-Use tab, and receives no update notifications. Malware uses the directory for quiet persistence.

A publicly disclosed vulnerability with a patch available, exploited in the window before defenders apply the fix — the vendor has known about it for N days, in contrast to a zero-day. Most real-world compromise comes from n-days, because patches and advisories double as attacker roadmaps.

Allows multiple devices on a local network to share a single public IP address.

An attack where a valid NTLM authentication is forwarded in real time to a different service than the one intended, granting the attacker the victim's access without ever cracking a credential.

A security function that decides whether a user or device may join a network and what access it receives, enforced by switches, wireless controllers, and VPNs that consult a central policy server such as Cisco ISE. Because every network device trusts its verdicts, the NAC server is one of the most privileged systems in an estate.

The standard protocol for synchronising clocks across networked systems, operating over UDP port 123. Because NTP traffic is ubiquitous and often allowed outbound, attackers mimic it to hide command-and-control beacons, as the StyleSmuggler implant did by sending server-mode NTP-shaped packets.

A VPN provider's commitment to not record or store user activity, connection times, or IP addresses.

An open standard authorization protocol that allows applications to access user resources without exposing passwords, using tokens instead of credentials.

A mechanism in OAuth that limits an application's access to a user's account, defining specific permissions like read email, send messages, or access files.

Over-The-Air update—firmware or software updates delivered wirelessly without physical connection.

A configuration in which any visitor can create an account on a self-hosted service without admin approval. It converts authenticated-only vulnerabilities into effectively unauthenticated ones, because the attacker can create the account the exploit requires.

Software with publicly available source code that anyone can inspect, modify, and distribute.

An open-source VPN protocol widely considered secure and reliable, though slower than WireGuard.

An emergency security patch released outside the normal update schedule to address critical vulnerabilities that can't wait for the next Patch Tuesday.

A security extension to OAuth 2.0 that prevents authorization code interception attacks by using a cryptographic code verifier and challenge.

A database query in which the SQL statement is sent separately from the values it operates on, so user input can never be interpreted as SQL syntax. It is the standard defense against SQL injection, in contrast to building queries by string concatenation.

An attack technique where an attacker uses a captured password hash to authenticate without needing to crack or know the actual password.

Software that securely stores and auto-fills passwords, generating strong unique passwords for each account.

A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program.

The second Tuesday of each month, when Microsoft releases its scheduled batch of security updates. The predictable cadence lets defenders plan deployment, but AI-assisted vulnerability discovery has pushed recent releases past 900 CVEs, straining triage.

A web vulnerability (CWE-22) where user-supplied input in a file path escapes the directory the application intended to serve from, typically via parent-directory references, letting an attacker read or write files elsewhere on the server.

A social engineering attack using fake emails or websites to steal login credentials or personal info.

Directing incoming traffic on specific ports to a particular device on your network.

A flaw that can be exploited without valid credentials or an active session, typically by sending crafted input to a network-exposed service. Pre-auth bugs in internet-facing systems are the most urgent class to patch because any remote attacker can reach them.

A social engineering technique where attackers create a fabricated scenario (pretext) to manipulate victims into providing information or taking actions they normally would not.

An attack technique where an adversary gains elevated access rights beyond what was initially granted.

A Microsoft Entra ID feature enabling just-in-time privileged access, requiring approval and time limits for admin role activation to reduce standing privilege risks.

The parent-child chain of processes on a host, showing which process launched which. Hunting on lineage catches exploitation because compromised services spawn children they never would in normal operation.

A defensive-evasion technique in which malware names its running process to imitate a legitimate system process, such as a kernel worker thread or a font or time-sync daemon, so it blends into normal process listings. The StyleSmuggler implant used kworker, fc-cache and chronyd disguises.

An attack that embeds instructions in content a language model will process, so the model takes actions the operator did not intend. In blind prompt injection the attacker cannot see the output and instead confirms execution through a side channel such as a DNS callback to a domain they control.

Software owned by a company with restricted access to source code.

Network feature that prioritizes certain traffic types (like video calls) over others.

A social engineering technique where attackers offer something (like IT support) in exchange for information or access, exploiting the human tendency to reciprocate.

Remote Authentication Dial-In User Service, the protocol network devices use to ask a central server whether a user or device should be granted access and with what attributes. Each device shares a secret with the server, so a compromised server exposes the secrets of every device that trusts it.

A critical vulnerability class that allows an attacker to run arbitrary code on a target system from a remote location, typically over a network or the internet, without requiring physical access.

A platform used by IT providers to monitor, patch, script and remotely control large fleets of endpoints from a central console via a privileged agent on each machine. Because the console can execute code on every managed device, its compromise gives an attacker fleet-wide access, as in the 2026 N-able N-central attacks.

A flaw where the outcome of code depends on the timing of concurrent operations that share state without proper synchronization. Attackers exploit kernel race conditions by winning the timing window to corrupt data structures or bypass checks.

A cybercrime business model where ransomware developers create malware and license it to affiliates who conduct attacks in exchange for a share of ransom payments.

Wiping a device and reinstalling its operating system and firmware from clean vendor media rather than patching in place. Re-imaging is the standard recovery step for a compromised appliance because a patch closes the vulnerability but does not remove anything an attacker installed after exploiting it.