Cybersecurity from Scratch

Glossary ​

Cross-program glossary. Terms defined here are those likely to be reused across multiple programs. Program-specific terms live in the glossary section of each submodule.

When a term is first introduced in a submodule, add it there and here (if it is generally reusable).

A ​

  • Acceptable Use Policy (AUP) — policy setting the constraints and practices an employee must accept to receive access to organizational IT assets; typically signed at onboarding alongside the Information Security Policy.
  • Abuse case — description of how a feature could be misused by a malicious actor; the security counterpart to a user story; central to A06 · Insecure Design.
  • Access Control — enforcement of policy about what an authenticated identity may do to which resource. See also RBAC / ABAC / ReBAC, IDOR, Deny by default.
  • Access Control Policy (ACP) — policy defining what data and systems employees can access, plus password, session, monitoring, and offboarding rules.
  • Administrative Control — policy- and procedure-based control that describes what should be done (e.g. "databases must be protected from unauthorized access"). Sets the intent enforced by technical and physical controls.
  • Alignment — the degree to which security activities support the main goals of the business; the central concern of cybersecurity governance.
  • Asset-based approach — threat-identification technique that starts from a list of the assets an organization deems valuable and enumerates threats to each. Good for business-level risk assessments; not granular enough for technical work.
  • Attack Tree — hierarchical threat-modeling technique (Schneier, 1999) in which the root is an attacker's goal, joined by AND/OR gates to child sub-goals, with atomic attack steps at the leaves; leaves can be annotated with cost, skill, detectability or CVSS for aggregation.
  • Attacker-based approach — threat-identification technique that starts from the threat actors themselves — their motives, means and opportunity — and derives the threats they would pose. Best fit for vulnerability assessments and pen tests.
  • ATT&CK — see MITRE ATT&CK.
  • ATLAS — Adversarial Threat Landscape for AI Systems; MITRE's ML/AI specific complement to ATT&CK.
  • Annualized Loss Expectancy (ALE) — expected monetary loss per year from a specific threat against a specific asset: $\text{SLE} \times \text{ARO}$. Primary prioritization metric in quantitative risk assessment.
  • Annualized Rate of Occurrence (ARO) — expected number of times per year a threat will be realized against a given asset.
  • Application Security — the cybersecurity domain focused on security in the development and integration of software applications.
  • Asset — anything of value to the organization: data, systems, people, brand, revenue streams. The thing risk is measured against.
  • Asset Value (AV) — monetary value assigned to an asset in step 2 of a quantitative risk assessment.
  • Audit — structured evaluation of an organization’s compliance with a standard. Failing an audit typically leads to fines or penalties; sustained pass performance is a business differentiator.
  • Availability — one of the three goals of the CIA Triad: ensuring timely and reliable access to and use of information.

B ​

  • Broken Access Control — OWASP Top 10 A01:2025; category covering any failure to enforce policy about what an authenticated identity may do to which resource. Persistent #1 since 2021.
  • Brussels effect — phenomenon where EU regulations (notably GDPR) drive worldwide business behavior because compliance across all markets is cheaper than segmenting them.
  • Business Continuity Plan (BCP) — organization-wide plan for keeping the business operating during an emergency; uses the DR plan as one input.
  • Business Impact Analysis (BIA) — analysis that classifies information systems and data by their criticality to business operations; feeds stage 1 (Categorize) of the NIST Risk Management Framework.
  • BYOD — Bring Your Own Device; practice of allowing personally-owned devices onto corporate networks and data.

C ​

  • CAPEC — Common Attack Pattern Enumeration and Classification; MITRE-maintained catalog of attack patterns; complements ATT&CK at a slightly higher level of abstraction.
  • CAR — Cyber Analytics Repository; MITRE-maintained collection of detection analytics tied to ATT&CK techniques.
  • CCPA / CPRA — California Consumer Privacy Act and its amendment (California Privacy Rights Act) — give California residents rights over their personal information (know, delete, opt-out).
  • Change Management Policy — formal process for making changes to IT, software, and security services, with the goal of methodical rollout and minimized service impact.
  • CIA Triad — Confidentiality, Integrity, Availability. The three traditional goals of cybersecurity.
  • CIAS Triad — CIA plus Safety, reflecting IoT and embedded-system concerns where cyber failures can cause physical harm.
  • Circuit breaker — resilience pattern that stops sending traffic to a failing dependency for a cooldown period, then probes cautiously; core defence against retry storms in A10 · Mishandling of Exceptional Conditions.
  • CISM — Certified Information Security Manager; management-focused security certification from ISACA. Governance is its first domain.
  • CISO — Chief Information Security Officer; senior executive accountable for the security program.
  • CISSP — Certified Information Systems Security Professional; flagship security certification from (ISC)². Governance is its first domain.
  • Compliance ≠ Security — industry maxim capturing that meeting compliance requirements does not automatically make an organization secure.
  • Compliance-as-code — practice of expressing controls as machine-checkable policy (e.g. OPA/Rego, IaC scanning), enabling continuous verification.
  • Confidentiality — restricting information disclosure to authorized users and services.
  • Continuous Controls Monitoring (CCM) — automated, ongoing evaluation of the operating effectiveness of controls, replacing periodic manual audits.
  • Control Categories — the three ways controls are grouped by how they protect assets: Administrative (policy), Technical (technology), Physical (barriers and access).
  • Control Framework — catalog of specific security activities, technologies, configurations, and policies that can be tailored to a security program. Complements a governance framework.
  • Control Types — the six ways controls are grouped by when and how they act relative to an incident: Deterrent, Detective, Preventive, Corrective, Recovery, Compensating.
  • Corrective Control — control that returns a system to normal after an event (e.g. terminating a malicious connection, quarantining infected files).
  • Cost-Benefit Analysis — step 6 of quantitative risk assessment: comparing the cost of a countermeasure against the reduction in ALE it delivers. Positive benefit = countermeasure is financially justified.
  • Countermeasure — any measure (technical, procedural, or human) that mitigates a vulnerability. Also called a security control or a safeguard.
  • Credential stuffing — automated login attempts using email/password pairs leaked from other services; primary defence is rate limiting + breach-list checks + MFA (A07).
  • CSP (Content Security Policy) — HTTP response header restricting which sources of script/style/frame/image a browser will honor; defence-in-depth against XSS.
  • Cryptographic Failures — OWASP Top 10 A04:2025; any weakness in how data is protected at rest or in transit (weak algorithms, missing TLS, keys in code, MD5 password hashing, AES-ECB).
  • CSPM — Cloud Security Posture Management; continuous auditing of cloud configuration against policy (Wiz, Prisma Cloud, AWS Security Hub, etc.).
  • CVE (Common Vulnerabilities and Exposures) — public catalog identifier for a specific known vulnerability.
  • CVSS — Common Vulnerability Scoring System; NIST/FIRST-maintained 0.0–10.0 severity score with Base, Threat/Temporal, Environmental and (v4) Supplemental metric groups.
  • CWE — Common Weakness Enumeration; MITRE catalog of ~1,000 software weakness types; each OWASP Top 10 category is defined as a set of CWEs.
  • Cyber Resilience Act (CRA) — EU Regulation 2024/2847; imposes cybersecurity obligations on manufacturers of products with digital elements for their whole lifecycle; applies from 11 Dec 2027.
  • Cyber-insurance — insurance covering operational and legal costs of cybersecurity incidents; guided by ISO/IEC 27102.
  • Cybercrime — attacks motivated primarily by money.
  • Cybersecurity — the practice of protecting systems, networks, data, and the people using them from digital attacks.
  • Cybersecurity Governance — top-down approach to managing security activities and ensuring they are aligned to the business.

D ​

  • D3FEND — MITRE's defensive-technique catalog; every ATT&CK technique maps to countering D3FEND techniques with implementation guidance.
  • DAST — Dynamic Application Security Testing; scans a running app from the outside (Burp, ZAP, Nuclei).
  • Data minimization — principle of keeping identifying data no longer than necessary for the stated purpose.
  • Data portability — the right (per GDPR and comparable laws) to move personal data between service providers in a structured, machine-readable format.
  • Decomposition — threat-modeling step that breaks the target system into subroutines and modules to expose trust boundaries, data flows, inputs and privileged functions where controls can be applied.
  • Denial of Service (DoS) — attack that exhausts a system's resources (via a flaw such as a buffer overflow, or by overload) so legitimate users can no longer use the service; can be temporary or permanently destructive.
  • Deterrent Control — control that discourages an attack by raising its psychological or perceived cost (warning signs, login banners, fences).
  • Deny by default — every action is forbidden unless a policy explicitly grants it; the standard prevention pattern for A01 · Broken Access Control.
  • Dependency confusion — supply-chain attack where a public package with the same name as an internal package is installed first because the resolver isn't scoped; mitigated by scoped package sources (A03).
  • Deserialization — reconstructing an object from a byte stream; a security-critical operation when the byte stream is untrusted. Insecure deserialization is the highest-impact single pattern in A08.
  • DFD (Data-Flow Diagram) — notation using external entities, processes, data stores, data flows, and trust boundaries; the standard input to STRIDE and LINDDUN.
  • Detective Control — control that identifies policy violations or intrusions (authentication logs, application logs, SOC alerts, honeypots).
  • DREAD — threat-prioritization framework scoring each threat on five axes (typically 1–10): Damage potential, Reproducibility, Exploitability, Affected users, Discoverability.
  • Disaster Recovery (DR) Policy — plan for the technical recovery of hardware, applications, and data after a significant event; used as a component of the Business Continuity Plan.
  • DORA — EU Digital Operational Resilience Act (Regulation 2022/2554); requires ICT risk management, incident reporting, resilience testing, third-party ICT risk management, and information sharing for financial entities. Applies from 17 Jan 2025.
  • Dwell time — elapsed time between an attacker’s initial access and detection/containment; a primary driver of breach cost.
  • DPIA — Data Protection Impact Assessment; GDPR Art. 35 process required before starting processing likely to result in high risk to individuals. LINDDUN commonly serves as its technical section.

E ​

  • Elevation of privilege — attacker moves from a low-privilege context to a higher one (e.g. local admin, domain admin), enabling further attack. The "E" in STRIDE.
  • Email / Communication Policy — policy governing acceptable use of email and other corporate communication channels (blogs, chat, social media).
  • ENISA — European Union Agency for Cybersecurity.
  • EPSS — Exploit Prediction Scoring System; probability that a given CVE will be exploited in the next 30 days; companion to CVSS.
  • EU AI Act — EU Regulation 2024/1689; risk-tier-based regulation of AI systems (unacceptable / high / limited / minimal + GPAI) with extraterritorial scope and cybersecurity obligations for high-risk and systemic-risk models.
  • Exposure Factor (EF) — percentage of an asset’s value lost if a specific threat is realized against it. Subjective; used in step 3 of quantitative risk assessment.
  • Extraterritoriality — feature of laws like GDPR and the EU AI Act that applies obligations to providers outside the EU if they serve users inside the EU.

F ​

  • Fail closed / fail open — behavior of a security control when its dependencies are unavailable. Fail closed denies; fail open allows. Security decisions must always fail closed (A10).
  • Four-Question Framework — the four canonical questions every threat model answers: 1) What are we working on? 2) What can go wrong? 3) What are we going to do about it? 4) Did we do a good enough job? Adopted by OWASP, LINDDUN and the Threat Modeling Manifesto.

G ​

  • GDPR — EU General Data Protection Regulation — protects the privacy of individual personal data; fines up to €20M or 4% of global turnover; 72-hour breach notification requirement.
  • Governance — top-down approach to managing a business. In cybersecurity, the discipline that aligns security activities with business goals. See Cybersecurity Governance.
  • Governance Framework — business-process model focused on risk management; identifies risk to drive activities that reduce it to acceptable levels. Complements a control framework.
  • GRC — Governance, Risk, and Compliance — the discipline (and tool category) that manages these obligations end-to-end.

H ​

  • HIPAA — US Health Insurance Portability and Accountability Act — protects Personal Health Information (PHI).
  • Honeypot — a decoy system or account whose only purpose is to be attacked, so defenders can detect and study the attack; a detective control.
  • Hybrid Risk Assessment — combined quantitative + qualitative risk assessment that uses each technique where it is strongest; produces a balanced view of the organization’s risk posture.

I ​

  • IaC (Infrastructure as Code) — declarative definition of infrastructure (Terraform, CloudFormation, Bicep, Pulumi); enables IaC scanning of proposed changes before deploy (A02).
  • IDOR (Insecure Direct Object Reference) — vulnerability where a server-controlled reference (an ID in a URL/body) is trusted without authorization check; classic A01 example.
  • Idempotency key — client-supplied key that lets a server safely dedupe retried requests; core defence against duplicate side effects during timeouts (A10).
  • Impact — the consequence if a threat successfully exploits a vulnerability against an asset.
  • Incident Response (IR) Policy — organized approach to detecting, handling, and remediating incidents; typically operationalized through playbooks.
  • Information disclosure — exposure of confidential data — via breach, leak, or over-verbose error messages that reveal backend detail. The "I" in STRIDE.
  • Information Security — the cybersecurity domain focused on networks and internetworking.
  • Information Security Policy — high-level umbrella policy binding all employees to the security program; typically signed at onboarding.
  • Inherent Risk — the risk that exists before any controls are applied.
  • Injection — OWASP Top 10 A05:2025; class of vulnerabilities where untrusted input is concatenated into an interpreter (SQL, OS shell, LDAP, XPath, template, prompt); XSS was merged in from 2021.
  • Insecure Design — OWASP Top 10 A06:2025; category covering flaws that are inherent to the architecture (missing rate limits, insecure workflow, no abuse cases), fixable only by re-design not patching.
  • Integrity — ensuring data is not modified or deleted in an unauthorized or undetected manner.
  • IoT (Internet of Things) — networked embedded devices, often controlling physical machinery.
  • ISMS — Information Security Management System — the governance-level system defined by ISO/IEC 27001.
  • ISO/IEC 27001 — international standard defining requirements for an ISMS.
  • ISO/IEC 27002 — code of practice cataloging information security controls that support ISO/IEC 27001.
  • ISO/IEC 27017 / 27018 — cloud information security / PII protection in public clouds.
  • ISO/IEC 27035 — incident management principles and preparation guidance.
  • ISO/IEC 27036 — supplier and supply-chain security.
  • ISO/IEC 27102 — guidelines for cyber-insurance.
  • ISO/IEC 27701 — PIMS extension of ISO/IEC 27001; mapped to GDPR (Annex D).
  • ISO/IEC 42001 — international standard for AI management systems (AIMS); analog of ISO/IEC 27001 for AI.

J ​

  • JWT (JSON Web Token) — URL-safe token format widely used for session and API auth; historically prone to alg-confusion attacks ("alg: none", RS256/HS256 confusion) fixed by pinning algorithm at verification (A01, A02).

K ​

  • k-Anonymity — privacy property: every record in a dataset is indistinguishable from at least k-1 others on quasi-identifiers.
  • KDF (Key Derivation Function) — turns a secret (password or shared secret) into cryptographic key material; PBKDF2, HKDF, Argon2id.
  • KMS (Key Management Service) — managed service that generates, stores, and rotates keys inside an HSM or equivalent boundary (AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault).

L ​

  • Likelihood — the probability that a given threat will exploit a given vulnerability in a given time window.
  • LINDDUN — KU Leuven's privacy-focused threat-modeling methodology; seven threat categories — Linking, Identifying, Non-repudiation, Detecting, Data disclosure, Unawareness/Unintervenability, Non-compliance. Flavors: GO (workshop), PRO (full), MAESTRO (AI systems).

M ​

  • MFA (Multi-Factor Authentication) — authentication requiring two or more factors from different categories: know / have / are. Hierarchy of strength: SMS < TOTP < push (with number matching) < FIDO2 / Passkey.
  • MITRE ATT&CK — knowledge base of adversary Tactics, Techniques, and Common Knowledge grounded in real-world observations. Three matrices: Enterprise, Mobile, ICS. The lingua franca between threat modeling, detection engineering, red teaming and threat intelligence.
  • MTTD / MTTR — Mean Time to Detect / Mean Time to Respond; the two primary SOC efficacy metrics driven by A09.

N ​

  • Nation-state threat actor — an attacker aligned with the interests of a national government, typically concerned with espionage and geopolitical advantage.
  • NERC CIP — North American Electric Reliability Corporation — Critical Infrastructure Protection standards for the bulk electric system.
  • NIS2 — EU Directive 2022/2555; raises cybersecurity requirements for essential and important entities across many sectors; introduces management-body accountability.
  • NIST AI RMF — NIST AI Risk Management Framework (2023); voluntary framework structured as Govern / Map / Measure / Manage.
  • NIST CSF — NIST Cybersecurity Framework; the canonical framework spanning governance (Functions → Categories → Subcategories) and control (Informative References). NIST CSF 2.0 (2024) adds a Govern function and broadens scope beyond critical infrastructure.
  • NIST SP 800-63B — Digital Identity Guidelines — Authentication and Lifecycle Management; the authoritative reference for password rules (no forced periodic rotation, block breach-list matches, allow long passphrases) and Authenticator Assurance Levels AAL1/2/3.

O ​

  • OCTAVE — Operationally Critical Threat, Asset, and Vulnerability Evaluation; SEI's organization-level risk-assessment method. Variants: Original, S (small orgs), Allegro (streamlined, information-asset focus).
  • OWASP — Open Worldwide Application Security Project; the community that maintains the OWASP Top 10, ASVS, SAMM, Threat Dragon, ZAP, and dozens of other application-security resources.
  • OWASP Top 10 — the most widely referenced list of the most critical web-application security risks; refreshed every 3–4 years since 2003. Latest edition: 2025.
  • OWASP Threat Dragon — free open-source threat-modeling tool from OWASP supporting STRIDE and CIA-based models; desktop and web deployments.

P ​

  • Passkey — FIDO2/WebAuthn credential; a public/private keypair bound to an origin, replacing passwords. Immune to phishing, replay, and credential stuffing.
  • PASTA — Process for Attack Simulation and Threat Analysis; risk-centric 7-stage threat-modeling methodology (Definition of Business Objectives → Definition of Technical Scope → Application Decomposition → Threat Analysis → Vulnerability Analysis → Attack Simulation → Risk & Impact Analysis).
  • PCI DSS — Payment Card Industry Data Security Standard — protects payment card (cardholder) data.
  • PET (Privacy-Enhancing Technology) — broad family that includes differential privacy, homomorphic encryption, secure multi-party computation, federated learning, k-anonymity, pseudonymization.
  • PHI (Personal Health Information) — health-related information regulated for confidentiality.
  • Physical Control — control that prevents physical access to or damage of assets (biometrics, key locks, cages, cameras).
  • PII (Personally Identifiable Information) — information that can be used to identify a person (e.g. SSN, address, DOB).
  • PIMS — Privacy Information Management System — privacy extension of an ISMS defined by ISO/IEC 27701.
  • Playbook — a prescriptive procedure — typically a checklist — invoked when a specific condition is met, most commonly during incident response.
  • PnG (Persona non Grata) — attacker-persona technique developed at SEI; describes malicious actors by skills, motives, and goals — UX personas applied in reverse.
  • Policy — formal statement of management’s expectation and intent for a specific aspect of security. Explains why an action must be taken or avoided. Enforced by standards.
  • PQC (Post-Quantum Cryptography) — cryptographic algorithms believed to resist attack by large quantum computers; 2024 NIST standards include ML-KEM (FIPS 203, key encapsulation) and ML-DSA (FIPS 204, signatures).
  • Preventive Control — control that blocks unauthorized access, modification, or destruction of assets (antivirus, passwords, MFA, firewalls).
  • Proactive threat modeling — threat modeling performed before an asset is deployed; drives design and control decisions early.
  • Probability × damage — simple quantitative threat-prioritization technique that multiplies how likely a threat is by the damage it would cause, producing a 1–10 rating (10 = highest priority).
  • Procedure — formal method describing how to perform a task; can be a step-by-step checklist. See also Process, SOP, Playbook.
  • Process — used interchangeably with Procedure.
  • Provenance — verifiable record of how an artifact was built, by whom, from which sources; SLSA defines increasingly strict provenance levels.
  • pytm — OWASP threat-modeling-as-code library (Python); models are Python code, output is Markdown / DFD / attack trees.

Q ​

  • Qualitative Risk Assessment — risk-analysis technique based on expert opinion (surveys, interviews, workshops); output is a prioritized list, not dollar values.
  • Quantitative Risk Assessment — risk-analysis technique that produces measurable dollar values (AV, EF, SLE, ARO, ALE) via a six-step method ending in a cost-benefit analysis.
  • Quantitative TMM — SEI's Quantitative Threat Modeling Method; hybrid of per-STRIDE-category attack trees with CVSS-scored leaves.
  • Quasi-identifier — attribute that is not directly identifying but, combined with others, can re-identify an individual (ZIP + DOB + sex).

R ​

  • RACI matrix — documentation assigning each task’s Responsible / Accountable / Consulted / Informed roles.
  • Reactive threat modeling — threat modeling performed during the operational life of an asset; surfaces new threats and refines existing controls as the environment changes.
  • Reasonable care — legal standard for whether an organization did enough to protect information; documented policies are the primary evidence.
  • ReDoS (Regular-Expression DoS) — catastrophic-backtracking regex that spikes CPU on malicious input; classic A10 tail-latency killer.
  • Repudiation — an actor's ability to deny performing an action; attackers exploit weak logging to shift blame or fake third-party origin. The "R" in STRIDE.
  • Remote Access Policy — policy defining acceptable methods for connecting to internal networks from outside, including BYOD rules.
  • Residual Risk — the risk remaining after controls have been applied.
  • Recovery Control — an extension of a corrective control that restores full functionality (off-site backups, DR site, restore procedures).
  • Right to be forgotten — GDPR right to have personal data deleted on request.
  • Risk — the combination of likelihood and impact against a valuable asset; the degree to which threats and vulnerabilities intersect. The central quantity that security programs manage.
  • Risk Acceptance — explicit, documented, approved decision to take no further action on a risk; periodically reviewed.
  • Risk Assessment — process of identifying risks and evaluating how significant each one is; the input to risk treatment decisions.
  • Risk Management Framework (RMF) — NIST SP 800-37; a six-stage cyclic process for near-real-time risk management: Categorize → Select → Implement → Assess → Authorize → Monitor.
  • Risk Mitigation — applying controls that reduce the likelihood or impact of a risk.
  • Risk Response — the chosen action for a given risk: Mitigate, Transfer, or Accept. (Ignore is not a valid response.)
  • Risk Transfer — assigning risk to a third party via insurance or outsourcing.
  • Risk Treatment — the chosen response to a risk: mitigate, transfer, avoid, or accept.

S ​

  • Safeguard — see Countermeasure.
  • Safety (in the CIAS Triad) — reducing risk that embedded/IoT technology failures or manipulation cause physical harm.
  • SANS — SANS Institute; widely used source of free information security policy templates.
  • Software-based approach — threat-identification technique driven by a diagram of the software's users, data stores and privileges; each component is examined for threats. Best fit for developers examining their own applications.
  • Spoofing — using a falsified identity (phished email, spoofed MAC/IP, fake employee) to impersonate a trusted party. The "S" in STRIDE.
  • SBOM — Software Bill of Materials — machine-readable inventory of software components; increasingly required (US Executive Order 14028, EU CRA).
  • SCA (Software Composition Analysis) — scanning that identifies open- source dependencies and their known CVEs (Dependabot, Snyk, Trivy, Grype).
  • Security Cards — University of Washington's 42-card brainstorming deck across four dimensions (Human Impact, Adversary's Motivations, Adversary's Resources, Adversary's Methods).
  • Security Misconfiguration — OWASP Top 10 A02:2025; category covering default credentials, verbose errors, unpatched components, open cloud buckets, missing security headers, over-permissive IAM.
  • SEC cyber disclosure rules — US Securities and Exchange Commission rules (2023) requiring public companies to disclose material cyber incidents within 4 business days and to disclose cyber risk management, strategy, and governance annually.
  • Security Control — see Countermeasure.
  • Shadow regulator — non-governmental actor (typically cyber-insurance underwriters) whose requirements effectively function as compulsory standards.
  • SIEM — Security Information and Event Management; aggregates and correlates security telemetry (Splunk, Sentinel, Chronicle, Elastic).
  • Sigstore / cosign — Linux Foundation project for keyless signing of container images and artifacts using OpenID identities; standard tooling for SLSA-compliant supply chains.
  • Single Loss Expectancy (SLE) — expected monetary loss from one occurrence of a threat against an asset: $\text{AV} \times \text{EF}$.
  • SLSA — Supply-chain Levels for Software Artifacts; OpenSSF-maintained framework with build integrity levels L1–L4; the reference framework for A03 mitigation.
  • SOC — Security Operations Center; team + tooling that monitors, detects, triages, and responds to security events.
  • Software or Data Integrity Failures — OWASP Top 10 A08:2025; covers insecure deserialization, unsigned updates, tampered dependencies.
  • Software Supply Chain Failures — OWASP Top 10 A03:2025 (formerly "Vulnerable and Outdated Components"); expanded to cover the full build and distribution pipeline (SolarWinds, Log4Shell, XZ-Utils).
  • SOP (Standard Operating Procedure) — a repeatable, documented procedure that reliably reproduces an action or result; the concrete artifact by which a standard is followed.
  • SRI (Subresource Integrity) — browser feature that verifies a fetched script/stylesheet matches a declared cryptographic hash before executing.
  • SSRF (Server-Side Request Forgery) — vulnerability where a server fetches an attacker-controlled URL, typically reaching internal services; absorbed into A10:2025.
  • SSTI (Server-Side Template Injection) — injection into a server-side templating engine (Jinja2, Freemarker, Handlebars); frequently leads to RCE.
  • Standard — formally established requirement satisfying specific control objectives under a policy. Explains what must be done. Prescriptive and narrowly focused; enforces policy and is implemented by procedures.
  • STRIDE — Microsoft's threat-categorization framework applied per component: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

T ​

  • Tabletop exercise — rehearsal of an incident-response playbook via a discussion-based simulation, used to test and improve procedures; often cross-functional (security, legal, marketing, sales).
  • Tampering — unauthorized modification of systems or data, at rest or in transit — typically due to weak or absent encryption. Violates integrity. The "T" in STRIDE.
  • Technical Control — control that uses technology to enforce administrative direction (passwords, ACLs, MFA, encryption, firewalls).
  • Threat / Threat Actor — an entity motivated to attack systems, data, or people; more broadly, any potential cause of an unwanted incident (including non-adversarial threat events like fires or hardware failure).
  • Threat Intelligence — the specialty of studying and reporting on the threat landscape.
  • Threat-Led Penetration Testing (TLPT) — advanced testing regime required under DORA for significant financial entities.
  • Threat modeling — structured, typically whiteboard-driven exercise that enumerates plausible attacks against an asset, categorizes and prioritizes them, and identifies controls to eliminate or reduce each. Run proactively (before deployment) and reactively (throughout the asset's life).
  • Threat Modeling Manifesto — 2020 industry statement (Adam Shostack, Avi Douglen and colleagues) codifying values, principles, patterns and anti-patterns for effective threat modeling; foundational to Module 2.
  • Threat-Informed Defense — MITRE-coined discipline of aligning defenses to the specific ATT&CK techniques adversaries use against you.
  • TOCTOU (Time-of-Check to Time-of-Use) — race condition where a check and a use are separated in time; the underlying pattern of many privilege escalation and integrity bugs.
  • Trike — open-source security-audit framework using actor–asset–action matrices, DFDs and attack trees; produces auditable, formal artifacts.
  • Trust boundary — location in a system where the trust or security level changes; a natural place to insert a control (validate inputs, re-authenticate, re-encrypt).
  • Typosquatting — supply-chain attack that publishes a malicious package under a name typographically close to a popular one (requsts, lodahs).

V ​

  • VAST — Visual, Agile, and Simple Threat Modeling; enterprise-scale, tool-driven methodology (ThreatModeler). Uses two model types per system: application (process-flow) and operational (data-flow).
  • Vulnerability — a weakness or lack of countermeasures in software, hardware, business processes, or people.

W ​

  • WAF (Web Application Firewall) — reverse proxy that inspects HTTP traffic against rules and blocks likely attacks; defence-in-depth for A05.
  • WebAuthn — W3C standard for public-key browser authentication; the browser API underlying Passkeys.

X ​

  • XSS (Cross-Site Scripting) — injection of script into a page rendered by another user's browser; three types: reflected, stored, DOM-based. Merged into A03:2021 Injection and remains inside A05:2025.

72-hour rule ​

  • 72-hour rule — GDPR requirement to notify supervisory authorities within 72 hours of a personal-data breach.

Personal learning notes — cybersecurity curriculum.

Content maintained by the author.