Tech Glossary — Page 5

A forensic image is a bit-for-bit copy of a disk or volume, taken so investigators can examine a system's state without changing the original. It is usually recorded with a hash to prove it was not altered.

A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs.

Fortinet's cloud-based management and services platform that provides centralized management, logging, reporting, and single sign-on capabilities for Fortinet security products.

A sequence of objects assembled from classes already present in an application and its libraries, arranged so that reconstructing them during deserialization performs an unintended action such as running a command or loading code. Finding one is the core of deserialization exploitation.

Restricting access to content based on the user's geographic location.

A script that Git executes automatically when a repository event occurs, such as a push, commit, or index write. Hooks are plain executable files in the repository's hooks directory and run with the privileges of the user running Git, which makes them a code-execution primitive on hosting servers.

GitHub's built-in automation and CI/CD platform. It runs workflows defined in YAML files under a repository's .github/workflows directory, and those jobs can read the repository's stored secrets and reach the network.

An attack in which an adversary who has obtained the signing key or credentials of an identity provider forges valid SAML authentication tokens for any user, including administrators. Because the tokens are correctly signed, downstream services trust them without a further password check.

A high-performance runtime that can execute JavaScript, Python and other languages inside a Java process through a polyglot context. That context can grant guest scripts access to host Java classes, so its security depends entirely on how strictly host access is configured.

HAProxy is an open source load balancer and reverse proxy for TCP and HTTP traffic. Many appliances use it as their front end, so a changed HAProxy rule can quietly route traffic to an attacker's tool.

A construction that combines a secret key with a message and a hash function to produce a code that verifies both the integrity and authenticity of the message. It underpins signed URLs, API request signing, and session token validation.

An attack that exploits disagreement between two HTTP parsers, typically a front-end proxy and a back-end server, about where one request ends and the next begins. The attacker slips a hidden request past the front end's security checks to reach the back end directly.

Hash-checking mode is a pip feature that compares every downloaded package against SHA-256 hashes stored in your requirements file and aborts the install on any mismatch. It requires exact versions for every dependency.

A content management system that stores and serves content through an API with no built-in front end, leaving presentation to a separate application. Strapi is a widely used example.

A memory-corruption bug where a program writes more data into a heap allocation than it was sized to hold, spilling into adjacent memory. When the overwritten neighbor is the allocator's own bookkeeping, an attacker can steer it toward code execution.

Representing a character in a URL or protocol as a percent sign followed by its two-digit hexadecimal byte value, such as %6a for the letter j. Improper or inconsistent handling of hex encoding (CWE-177) lets an attacker write a protected path in a form that an access rule fails to recognize but a downstream handler still decodes and serves.

Two appliances or servers configured so that one actively serves traffic on a shared virtual address while the other stands by and takes over on failure. HA protects against independent hardware or software faults, not against attacks that crash both nodes the same way.

A decoy system deployed to be attacked so defenders can observe exploitation attempts safely. Honeypot networks give early warning that a vulnerability has moved from theoretical to actively exploited, often before official catalogs like CISA KEV confirm it.

A host-based WAF is a web application firewall installed on the web server itself, usually as a module in Apache httpd, Nginx or IIS, that inspects HTTP requests inside the server before the application handles them.

A web application such as cPanel & WHM, Plesk, or DirectAdmin that manages a hosting server's accounts, websites, mail, and databases. It runs with root privileges and loads third-party plugins, so a flaw in the panel or a plugin can expose every customer on the server.

An out-of-cycle software update that addresses a specific urgent defect, usually a security flaw, on an existing release line without waiting for the next scheduled version. Hotfixes are typically numbered and cumulative on that line, but each covers only the issues named in its notes, so a later one may be required.

Software that creates and manages virtual machines by allocating physical hardware resources among multiple guest operating systems. VMware ESXi is a Type 1 (bare-metal) hypervisor.

The protocol IPsec uses to negotiate cryptographic parameters, exchange keys, and authenticate peers before a tunnel is established. It listens on UDP/500, and on UDP/4500 when NAT traversal is used, which makes it internet-facing on most VPN gateways.

A unique numerical identifier assigned to every device connected to the internet.

A network access control that permits connections to a service only from an explicit list of approved source addresses or subnets, denying everything else. Applied at the edge, on the host, or both.

A security system that monitors network traffic for malicious activity and can automatically block or prevent detected threats in real-time.

A suite of protocols that authenticates and encrypts IP traffic at the network layer, used for site-to-site tunnels between gateways and for many remote-access VPNs. IKE handles the negotiation; ESP carries the protected packets.

Services that continuously watch for signs that your personal information is being misused, including monitoring credit reports, dark web activity, and public records.

A Microsoft Entra ID Premium feature that uses machine learning to detect risky sign-ins and user behaviors, automatically enforcing remediation like MFA challenges or password resets.

A system that creates, maintains, and manages identity information for users while providing authentication services to relying party applications through protocols like SAML or OAuth.

A public-key scheme that derives a recipient's encryption key from an identity such as an email address, removing the need for pre-enrolled certificates or keys. FortiMail uses IBE to deliver encrypted mail to external recipients through a web portal, which is also the surface exposed by CVE-2026-104286.

An attack technique where adversaries register malicious OAuth applications that request excessive permissions, then trick users into authorizing them.

An image digest is the SHA-256 content hash that uniquely identifies a container image. Unlike a tag such as latest, a digest cannot be repointed to different content, so pinning by digest keeps deployments on a tested build.

A backup written so that it cannot be modified or deleted for a defined retention period, even by an administrator. Immutability protects recovery data from ransomware and from insiders who hold privileged credentials, since the copy survives even if the live environment is fully compromised.

A backdoor loaded and executed inside a running process without being written to disk as a file. Because no file exists for scanners to detect, it must be hunted through process behavior, memory analysis, and logs rather than file signatures.

A file already present on a server that, when pulled in by a file-inclusion bug, converts a limited primitive into code execution because the attacker can steer its behavior. PEAR's command helper is a common example: included with attacker-supplied arguments, it writes a chosen PHP payload to disk.

A security fix that blocks the reported exploit path without correcting the underlying weakness, leaving an alternative route to the same bug. The follow-up is often assigned its own CVE; N-central's CVE-2026-18577 was formally described as the result of an incomplete patch for CVE-2026-18556.

Forensic artifacts that signal a system may have been breached, such as unexpected files, unusual process restarts, known-malicious IP addresses, or file hashes. Responders use published IoCs to hunt for evidence of exploitation after a vulnerability is disclosed.

The controllers, sensors, actuators and supervisory software that automate an industrial or building process. Supervisory refrigeration managers, PLCs and building management controllers are all ICS components, and CISA publishes dedicated ICS advisories for their vulnerabilities.

An industrial IoT gateway is a small computer that collects data from machines and plant systems and forwards it to business networks or the cloud, translating between industrial and IT protocols.