ReconnaissanceGathering information about a person, organization, system, or environment before or during an operation.
OSINTOpen-source intelligence: collecting and analyzing information from publicly available sources.
TargetThe person, account, device, application, organization, or outcome an operation focuses on. It may be known first or identified during reconnaissance.
Attack surfaceAll reachable places where a system or person could be exposed to an attack.
VulnerabilityA weakness that may be used to violate a security requirement.
ExploitA method or code that takes advantage of a vulnerability.
ThreatAnything capable of causing harm to an asset.
RiskThe possibility and impact of a threat using a vulnerability.
AuthenticationProving an identity, such as with a password, passkey, token, or biometric.
AuthorizationDeciding what an authenticated identity is allowed to do.
Least privilegeGiving only the access needed for a task or role.
HashA one-way transformation that produces a fixed-style output from input data.
SaltUnique extra data combined with a password before hashing to reduce the value of precomputed lookup tables.
EncryptionTransforming readable data into protected ciphertext using a key.
EncodingChanging data into another representation for storage, transmission, or compatibility; it is not automatically secrecy.
FirewallA control that allows or blocks traffic according to rules.
HardeningReducing attack surface and strengthening a system’s configuration.
PatchAn update that fixes defects or vulnerabilities.
LogA time-stamped record of events generated by systems and applications.
Incident responsePreparing for, detecting, containing, removing, recovering from, and learning from security incidents.
Social engineeringInfluencing people to reveal information, approve access, send money, or take another risky action.
CybersecurityThe practice of protecting systems, networks, applications, devices, and data from unauthorized access, disruption, alteration, or destruction.
NetworkTwo or more connected devices that exchange data and share services or resources.
Zero-dayA newly discovered vulnerability for which defenders may have no vendor patch yet; attackers may try to exploit it before a fix is available.
File systemThe structure and rules an operating system uses to name, organize, store, locate, protect, and recover files on a storage device.
HackingUsing technical knowledge to explore, test, change, or control technology. It is ethical only when it is authorized, scoped, and used responsibly.