Security Glossary — Acronyms and Terms Across the Track

A one-line definition for every acronym and term used across the curriculum, with the phase/module where it's covered in depth. Use it as a quick reference; follow the pointer for the full from-zero treatment. Organized alphabetically. (Pnn = phase; module names link to the mastery modules.)

A

  • ABAC — Attribute-Based Access Control: authorize by attributes of subject/resource/action/context. P02, P07.
  • ABI — Application Binary Interface: the machine-level calling convention/layout contract. P01.
  • AEAD — Authenticated Encryption with Associated Data (AES-GCM, ChaCha20-Poly1305): confidentiality + integrity in one. P02.
  • AD — Active Directory: Microsoft's enterprise directory/auth backbone. P05.
  • ADP — Authorized Data Publisher: a party that enriches a CVE record (e.g. CISA Vulnrichment). P08.
  • AMSI — Antimalware Scan Interface: lets defenders inspect de-obfuscated script content in memory. P05, P09.
  • APK / AAB — Android Package / App Bundle: the app artifact / Play upload format. P04.
  • ASLR — Address Space Layout Randomization: randomizes memory layout; defeated by an info leak. P01, P08.
  • ASM — Attack-Surface Management: continuously discovering your own exposed assets. Offensive module.
  • ASVS — OWASP Application Security Verification Standard: the verifiable-requirements catalog (L1–L3). Standards module, P03.
  • ATT&CK — MITRE's tactic→technique matrix of adversary behavior. P09, Standards & Offensive modules.
  • AT (CVSS v4) — Attack Requirements, a new v4 base metric. Standards module Lab 05.
  • ATO — Authorization to Operate: a system's formal authorization (FedRAMP/RMF). P15.
  • ATS — App Transport Security: iOS policy forcing good TLS by default. iOS module.
  • ATT (App Tracking Transparency) — iOS opt-in prompt for cross-app tracking. iOS module.

B

  • BCP 38 — RFC 2827 ingress filtering (source-address validation) to stop spoofed packets. Availability module.
  • BEC — Business Email Compromise: fraudulent-instruction email attack. P02, Offensive module.
  • BLE — Bluetooth Low Energy. Wireless module.
  • BMC — Baseboard Management Controller: out-of-band, network-reachable server management processor. P13.
  • BOLA / IDOR — Broken Object-Level Authorization / Insecure Direct Object Reference: the flagship authz bug. P02.
  • BOPLA — Broken Object Property-Level Authorization (mass assignment). P02.

C

  • C2 — Command-and-Control: the channel a compromised host uses for instructions/exfil. P09, Offensive module.
  • CA — Certificate Authority: signs certs binding a key to a name. P02, P02 Lab 10.
  • CAPEC — Common Attack Pattern Enumeration and Classification (MITRE). Standards module.
  • CCM — Cloud Controls Matrix (CSA): cloud control catalog with crosswalks. P07, Standards module.
  • CDN — Content Delivery Network: distributed edge caches. P02, Availability module.
  • CIS — Center for Internet Security: Controls + Benchmarks (hardening guides). Standards module, P05–P07.
  • CISA — US Cybersecurity and Infrastructure Security Agency: KEV, advisories, Secure by Design. P08, Standards module.
  • CNA — CVE Numbering Authority: an org authorized to assign CVE IDs. P08.
  • CNAPP / CSPM — Cloud-Native Application Protection Platform / Cloud Security Posture Management. P07.
  • CNI — Container Network Interface: the k8s pluggable networking component that enforces NetworkPolicy. P07.
  • CORS — Cross-Origin Resource Sharing: a relaxation of the Same-Origin Policy for reading responses (not an access control). P02.
  • CSP — Content Security Policy: a response header constraining resource sources (XSS defense-in-depth, frame-ancestors for clickjacking). P02.
  • CSPRNG — Cryptographically Secure Pseudo-Random Number Generator. P02.
  • CSRF — Cross-Site Request Forgery: abuse of ambient cookie authority. P02.
  • CVE — Common Vulnerabilities and Exposures: a unique public name for one vulnerability. P08.
  • CVSS — Common Vulnerability Scoring System (FIRST): 0–10 severity from a vector. P08, Standards module.
  • CWE — Common Weakness Enumeration (MITRE): the class of bug (e.g. CWE-89 SQLi). P08, Standards module.
  • chain of custody — the recorded, unbroken provenance of evidence. P00, P09.
  • confused deputy — a privileged component tricked into misusing its authority for an attacker. P02, P04.

D

  • DAC / MAC — Discretionary / Mandatory Access Control. P05.
  • DAST — Dynamic Application Security Testing: probe the running app. P03.
  • DEK / KEK — Data / Key Encryption Key (envelope encryption). P02, P07.
  • DEP / NX — Data Execution Prevention / No-eXecute: non-executable data pages; pushed attackers to ROP. P01, P08.
  • DICE — Device Identifier Composition Engine: layered device identity from a hardware secret. P13.
  • Diamond Model — adversary/capability/infrastructure/victim intrusion-analysis lens. Offensive & Standards modules.
  • differential privacy (DP) — calibrated-noise query privacy with a bounded ε guarantee. Privacy module.
  • DKIM — DomainKeys Identified Mail: signs email; survives forwarding. P02.
  • DMARC — Domain-based Message Authentication, Reporting & Conformance: ties SPF/DKIM to the visible From: via alignment + policy. P02.
  • DMZ — Demilitarized Zone: a buffer network between trust levels (the iDMZ in OT). P10.
  • DPIA — Data Protection Impact Assessment: GDPR's high-risk-processing risk assessment. Privacy module.
  • DSAR — Data Subject Access Request (and the right to erasure). Privacy module.
  • DoS / DDoS — (Distributed) Denial of Service. Availability module.

E

  • EAP / EAP-TLS — Extensible Authentication Protocol; certificate-based variant for 802.1X. Wireless module.
  • EC — Embedded Controller: small chip managing power/keyboard/thermals. P13.
  • ECB — Electronic CodeBook: a broken cipher mode that leaks structure. P02.
  • EDR / MDM — Endpoint Detection & Response / Mobile Device Management. P05, P09.
  • eBPF — in-kernel programmable observability/enforcement. P05.
  • ELF / PE / Mach-O — executable formats (Linux / Windows / Apple). P01.
  • EPSS — Exploit Prediction Scoring System (FIRST): probability of exploitation in 30 days. P08, Standards module.
  • evil twin — a rogue AP cloning a legitimate SSID with a stronger signal. Wireless module.
  • exploit primitive — a reliable read/write/control-flow capability a bug grants. P08.

F

  • FedRAMP — US government cloud authorization program (NIST 800-53 + continuous monitoring). P15.
  • FIDO2 / WebAuthn — phishing-resistant, origin-bound authentication (passkeys). P02 Lab 12.
  • FIPS — Federal Information Processing Standards (e.g. 140-3 validated crypto modules; 199 categorization). P15, Standards module.
  • FIRST — Forum of Incident Response and Security Teams: stewards CVSS, EPSS, TLP. Standards module.
  • Frida — dynamic instrumentation toolkit (hooks/rewrites functions at runtime). P04, iOS module.
  • fuzzing — feeding many inputs to find crashes; coverage-guided = evolutionary search. P08, P01.

G–H

  • GHSA — GitHub Advisory Database / Security Advisory. P08.
  • GOT — Global Offset Table: resolved-import address table; RELRO makes it read-only. P01.
  • HIBP — Have I Been Pwned: breach corpus queried via k-anonymity range. P02 Lab 11.
  • HMAC — keyed-hash MAC immune to length extension. P02.
  • HSTS — HTTP Strict Transport Security. P02.
  • HSM / KMS — Hardware Security Module / Key Management Service: key material in a hardened boundary. P02, P07.

I

  • IAM — Identity and Access Management (cloud). P07.
  • IaC — Infrastructure as Code (Terraform, etc.). P07.
  • IAST — Interactive Application Security Testing. P03.
  • iDMZ — Industrial DMZ: the brokered buffer between IT and OT. P10.
  • IDS / IPS — Intrusion Detection / Prevention System. P09.
  • IETF — Internet Engineering Task Force: publishes RFCs (TLS, OAuth, HTTP, JWT). Standards module.
  • IOC — Indicator of Compromise (hash/IP/domain) — low on the pyramid of pain. P09.
  • ISO/IEC 27001 — certifiable Information Security Management System; 27002 = controls; 29147/30111 = disclosure/handling. Standards module, P15.

J–K

  • JNI — Java Native Interface: the Java↔C/C++ boundary where memory bugs re-enter. P04.
  • JWT / JWS / JWE — JSON Web Token / Signature / Encryption; validation is a protocol, not decode(). P02.
  • k-anonymity — every record indistinguishable from k−1 others on quasi-identifiers. Privacy module.
  • KDF — Key Derivation Function; for passwords use slow/salted/memory-hard (Argon2id/bcrypt/scrypt/PBKDF2). P02.
  • Kerberos / Kerberoasting — ticket-based auth; offline-cracking service-account tickets. P05.
  • KEV — CISA Known Exploited Vulnerabilities catalog (confirmed in-the-wild). P08, Standards module.
  • Kill Chain — Lockheed Martin's linear intrusion-phase model. Offensive & Standards modules.

L–M

  • LAPS — Local Administrator Password Solution: unique per-host admin passwords (breaks credential-reuse). Offensive module.
  • l-diversity — each k-anonymous class has ≥ l distinct sensitive values (fixes homogeneity). Privacy module.
  • LOLBins — Living-off-the-Land Binaries: abusing trusted signed tools. P09, Offensive module.
  • LSM — Linux Security Module (SELinux/AppArmor): mandatory access control. P05, P06.
  • MAC (crypto) — Message Authentication Code; compare in constant time. P02.
  • MASVS / MASTG — OWASP Mobile App Security Verification Standard / Testing Guide. P04, iOS module.
  • MFA — Multi-Factor Authentication (phishing-resistant = WebAuthn/passkeys). P02.
  • MITRE — nonprofit owning CVE, CWE, CAPEC, ATT&CK, D3FEND. Standards module.
  • mTLS — mutual TLS: both peers authenticate. P02, P07.

N–O

  • NAT — Network Address Translation. P00.
  • NIST — US standards engine: SP 800 series, FIPS, CSF, RMF, NVD. Standards module, P15.
  • NVD — National Vulnerability Database (NIST enrichment of CVE). P08.
  • OAuth2 / OIDC — delegated authorization / identity layer on top. P02.
  • OCSP / CRL — Online Certificate Status Protocol / Certificate Revocation List. P02.
  • OSCAL — Open Security Controls Assessment Language (compliance as code). P15.
  • OSINT — Open-Source Intelligence (reconnaissance). Offensive module.
  • OTA — Over-the-Air (firmware update); must be signed + anti-rollback. P13.
  • OWASP — Open Worldwide Application Security Project: Top 10, ASVS, Cheat Sheets, ZAP. Standards module, P02/P03.

P

  • PAC — Pointer Authentication (ARM64): signs pointers to detect tampering. P01.
  • padding oracle — leaks CBC plaintext byte-by-byte via padding-validity feedback. P02.
  • PCI DSS — Payment Card Industry Data Security Standard (contractual). P15, Standards module.
  • PKCE — Proof Key for Code Exchange: binds the OAuth code to the initiating client. P02.
  • PKI — Public Key Infrastructure: CAs, chains, validation. P02.
  • PLC / RTU / HMI / SCADA / SIS — industrial control equipment / supervisory systems / safety system. P10.
  • PMKID — a WPA2 field enabling client-free offline handshake cracking. Wireless module.
  • prototype pollution — polluting JavaScript's shared Object.prototype. P02.
  • provenance / SLSA — verifiable build metadata / build-integrity levels. P14, P03.
  • pseudonymization vs anonymization — reversible tokenization (still personal data) vs irreversible. Privacy module.
  • Pyramid of Pain — indicators (cheap to change) vs TTPs (expensive). P09, Offensive module.

Q–R

  • RBAC / ReBAC — Role- / Relationship-Based Access Control (Zanzibar). P02, P07.
  • RCE — Remote Code Execution. P08.
  • ReDoS — Regular-expression Denial of Service (catastrophic backtracking). Availability module.
  • RELRO — RELocation Read-Only: makes the GOT read-only. P01.
  • RFID / NFC — radio-frequency / near-field identification; static-ID tags are clonable. Wireless module.
  • RMF — NIST Risk Management Framework (the ATO lifecycle). P15.
  • ROP — Return-Oriented Programming: chaining existing code gadgets to defeat NX/DEP. P01, P08.
  • rate limiting — token bucket / leaky bucket / fixed & sliding window (per-key). Availability module.

S

  • SAML / SCIM — XML SSO assertions / cross-domain provisioning. P02.
  • SAST — Static Application Security Testing (taint analysis). P03 Lab 04.
  • SBOM / VEX — Software Bill of Materials / Vulnerability Exploitability eXchange. P14, P03.
  • SAE — Simultaneous Authentication of Equals: WPA3's offline-cracking-resistant handshake. Wireless module.
  • SDLC — Software Development Life Cycle (secure = SSDF, shift-left). P03.
  • seccomp — syscall-filtering sandbox mechanism. P05, P06.
  • Secure Enclave / TEE / TrustZone / SGX / SEV-SNP / TDX — hardware-isolated execution. P05, P13.
  • SIEM — Security Information and Event Management (log platform). P09.
  • Sigstore / Cosign / Fulcio / Rekor — keyless signing + transparency log. P14.
  • SLSA — Supply-chain Levels for Software Artifacts (OpenSSF). P14.
  • SMM (ring -2) — System Management Mode: firmware more privileged than the kernel. P13.
  • SOC 2 — trust-services audit of operating controls. P15, Standards module.
  • SOP — Same-Origin Policy (the browser rule CORS relaxes). P02.
  • SPF — Sender Policy Framework: authorizes sending IPs for a domain (envelope, not visible From). P02.
  • SPIFFE / SPIRE — workload identity standard / runtime. P07.
  • SQLi / XSS / SSRF / SSTI / XXE — injection / cross-site scripting / server-side request forgery / template injection / XML external entity. P02.
  • SSDF — NIST Secure Software Development Framework (SP 800-218). P03.
  • SSVC — Stakeholder-Specific Vulnerability Categorization: decision tree (Track/Track*/Attend/Act). P08, Standards module Lab 05.
  • STIX / TAXII / MISP — structured threat-intel format / transport / sharing platform. Standards module Lab 04.
  • STRIDE — Spoofing/Tampering/Repudiation/Info-disclosure/DoS/Elevation threat taxonomy. P03.
  • subdomain takeover — claiming a dangling DNS record pointing at a deprovisioned resource. Offensive module.

T–U

  • TCC — Transparency, Consent, and Control: Apple's privacy-permission system. P05, iOS module.
  • TLP — Traffic Light Protocol: intel-sharing handling labels. FIRST; Standards module.
  • TLS — Transport Layer Security (1.3 = RFC 8446). P02, P02 Lab 10.
  • TOCTOU — Time-Of-Check to Time-Of-Use race (incl. web race conditions). P01, P02, P06.
  • TPM / PCR — Trusted Platform Module / Platform Configuration Register (extend-only). P13.
  • TTP — Tactics, Techniques, and Procedures (the behavior level of intel). P09.
  • token bucket — rate-limiting algorithm: sustained rate + controlled bursts. Availability module.
  • UAF — Use-After-Free. P01, P08.
  • UAC — User Account Control (explicitly not a security boundary). P05.
  • UBSan / ASan / MSan / TSan — Clang sanitizers (UB / address / memory / thread). P01, P08.

V–Z

  • variant analysis — finding all instances of a bug class, not just the one found. P08.
  • VEX — see SBOM/VEX. P14.
  • VRP — Vulnerability Reward Program (bug bounty) + coordinated disclosure. P00, P08.
  • WAF — Web Application Firewall (edge request filtering). P02, P03.
  • WebAuthn — see FIDO2. P02 Lab 12.
  • WPA2 / WPA3 / 802.1X — Wi-Fi security (PSK handshake / SAE / Enterprise). Wireless module.
  • XSW — XML Signature Wrapping (a SAML parser-differential attack). P02.
  • YARA — pattern-matching rules over files/memory for malware classification. P09 Lab 04.
  • Zanzibar — Google's ReBAC authorization system. P02, P07.
  • Zero Trust — authorize every request by identity/context, not network location (NIST 800-207). P07.

This glossary indexes the deep treatments; for any term, open the linked phase/module WARMUP for the full from-zero explanation, mechanism, attack/defense, and misconception.