Tech Glossary — Page 7

Techniques that circumvent multi-factor authentication protections, including token theft, real-time phishing proxies, MFA fatigue attacks, and OAuth abuse.

A company that operates IT infrastructure and security for many client organisations under contract, typically through shared RMM and remote-access tooling. That shared tooling concentrates privilege, so an MSP compromise can cascade into every client it manages.

An Active Directory account that represents a computer or service rather than a person. Machine accounts often hold broad privileges, which makes them high-value targets for relay attacks.

An umbrella term for threat groups and techniques that skim payment card data from compromised online checkout pages, typically by injecting malicious code into the storefront. It is a recurring monetisation path for e-commerce breaches and part of why storefronts are high-value targets.

An attack in which the adversary positions themselves on the network path between two parties and relays, reads or alters their traffic. Against update clients, a MitM attacker who defeats certificate validation can substitute a malicious catalog or payload for the vendor's.

A service that combines security tooling with a human team that monitors, investigates and responds to threats on a customer's behalf. MDR providers often publish analysis of new attacks they observe across their customer base.

A platform for moving files between organizations or systems with authentication, encryption, audit logging and retention controls. Because MFT servers are internet-facing and hold current copies of regulated data, they are a favored target of data-theft extortion groups.

The interfaces and services used to configure and administer a device, as distinct from the data plane that carries user traffic. On a remote-access appliance the management plane is the admin console; exposing it to the internet or to the user-facing portal is a common root cause of privileged compromise.

Mark of the Web is a zone tag Windows writes on files downloaded from the internet or the Restricted sites zone. Office, Protected View and SmartScreen read it to decide whether to block macros or warn the user before a file opens.

Mass assignment is an API weakness in which client input is bound directly to internal object properties, letting a user set or change values they should not control, such as a role, price or status.

A new universal smart home standard backed by Apple, Google, and Amazon for cross-platform compatibility.

The analysis of a system's volatile memory to find running code, injected modules, network connections and secrets that may never be written to disk. It is often the only way to detect in-memory implants.

The property of code that cannot read or write memory outside the bounds and lifetime of the objects it owns. Languages like C and Objective-C leave this to the programmer, which is why parsers written in them produce the buffer overflows, out-of-bounds writes and use-after-free bugs that dominate exploited mobile vulnerabilities.

Memory-resident malware is malicious code that runs only in a device's RAM, usually inside a legitimate process, and leaves no executable on disk. A reboot clears it, but the access used to install it remains.

A network where devices connect to multiple nodes, extending coverage and providing redundancy.

Data about data—like email timestamps, file sizes, or location tags on photos.

Microsoft's subscription-based cloud productivity suite including Office applications, Exchange Online, SharePoint, and Teams.

Microsoft's cloud-based identity and access management service (formerly Azure Active Directory), providing authentication, SSO, and security features for Microsoft 365 and other applications.

Microsoft's cloud-based enterprise mobility management solution that provides MDM and MAM capabilities.

A family of malware that conscripts internet-connected consumer devices, such as routers and cameras, into a botnet. Operators use the distributed hosts for scanning, proxying and denial-of-service attacks.

A WSL networking mode that mirrors the Windows host network configuration into the Linux environment, improving VPN compatibility and enabling IPv6 support.

A weakness class in which software performs a sensitive operation without verifying the caller's identity at all, as opposed to checking it incorrectly. Typically found in management APIs, helper services and internal interfaces that were assumed to be unreachable by untrusted callers.

A vulnerability class (CWE-862) where an application authenticates who a user is but fails to check whether they are permitted to perform an action. The user is legitimately in the system; the flaw is that a permission boundary inside it is not enforced.

A subset of MDM that focuses on controlling corporate data within specific applications rather than managing the entire device.

Software that enables IT administrators to secure, monitor, and manage mobile devices accessing corporate resources.

A Mobility Conductor is the Aruba AOS-8 device that centrally manages configuration for a group of wireless controllers. It sits above the controllers, so a flaw in it can affect every site it manages.

An open standard that lets a language model discover and invoke external tools exposed by an MCP server, over a local stdio transport or a remote Streamable HTTP transport. Because MCP tools are arbitrary code with their own credentials, an authentication flaw on an MCP endpoint grants access to every connected system.

A privacy-focused cryptocurrency whose transactions are difficult to trace. Its anonymity and CPU-friendly mining make it the coin of choice for cryptojacking campaigns that mine on compromised machines.

Authentication requiring two or more verification factors—something you know, have, or are.

A hosting model in which many customers share one server, one kernel, and one file system, each as a separate low-privileged local user. Any local privilege escalation bug on the host can turn one compromised customer account into control of all of them.

A cryptocurrency wallet that requires multiple private key signatures to authorize transactions, providing enhanced security by eliminating single points of failure.

A WordPress plugin placed in the wp-content/mu-plugins directory, which loads automatically before normal plugins, cannot be deactivated from the admin interface, shows only under a separate Must-Use tab, and receives no update notifications. Malware uses the directory for quiet persistence.

A publicly disclosed vulnerability with a patch available, exploited in the window before defenders apply the fix. The vendor has known about it for N days, in contrast to a zero-day. Most real-world compromise comes from n-days, because patches and advisories double as attacker roadmaps.

Allows multiple devices on a local network to share a single public IP address.

An attack where a valid NTLM authentication is forwarded in real time to a different service than the one intended, granting the attacker the victim's access without ever cracking a credential.

A lifetime identifier a government assigns to each resident, such as Denmark's CPR number or the US Social Security number. It is designed to be stable and widely shared, which makes it a strong identifier and an unsuitable authenticator.

NetFlow is a network protocol, originally from Cisco, in which routers and switches export summary records of traffic flows (addresses, ports, byte counts, times) to a collector for monitoring and investigation.

A security function that decides whether a user or device may join a network and what access it receives, enforced by switches, wireless controllers, and VPNs that consult a central policy server such as Cisco ISE. Because every network device trusts its verdicts, the NAC server is one of the most privileged systems in an estate.

Dividing a network into isolated zones with controlled traffic between them so that a compromise in one zone, such as a helpdesk segment, cannot reach systems in another without crossing an enforced boundary.

The standard protocol for synchronising clocks across networked systems, operating over UDP port 123. Because NTP traffic is ubiquitous and often allowed outbound, attackers mimic it to hide command-and-control beacons, as the StyleSmuggler implant did by sending server-mode NTP-shaped packets.