Glossary

159 terms. Security writing is dense with abbreviations, and most of them hide a simple idea. Where a term means different things in different contexts, we say which one we mean.

Endpoint security

AMSI — Antimalware Scan Interface

A Windows interface that lets security software inspect script content after it has been de-obfuscated, at the moment the interpreter is about to run it. It is how malicious PowerShell is caught despite layers of encoding.

C2 — Command and Control

The channel malware uses to receive instructions from an attacker and send stolen data back. Detecting C2 traffic is often how a quiet intrusion is finally noticed.

DLL — Dynamic Link Library

A shared code file Windows programs load at runtime. Attackers abuse this by planting a malicious DLL where a trusted program will find it first — search-order hijacking.

eBPF — extended Berkeley Packet Filter

A modern Linux facility that lets security tools observe kernel activity safely, without loading a custom kernel driver that could crash the machine.

EDR — Endpoint Detection and Response

Software on the same device that assumes something will get through. It continuously records what processes do — what they launch, read, write and connect to — so an analyst can reconstruct an attack and contain it. EPP is the gate; EDR is the camera and the response team.

EPP — Endpoint Protection Platform

Software on a laptop, server or device that tries to stop malicious code before it runs. It decides at the gate: known-bad file, suspicious structure, blocked exploit technique. When EPP works, there is no incident to investigate.

EPP/EDR — Endpoint Protection Platform / Endpoint Detection and Response

The two layers written together, as they are now delivered — one agent doing prevention and detection rather than two products.

IOC — Indicator of Compromise

A concrete artifact that signals a known attack: a file hash, a domain, an IP address. Useful for catching threats seen before, useless against anything genuinely new.

LSASS — Local Security Authority Subsystem Service

The Windows process that holds credentials in memory. Reading its memory is the classic credential theft step, which is why any unusual process touching it is treated as serious.

MDR — Managed Detection and Response

A service, not a product. Someone else's analysts operate your detection platform — triaging alerts, hunting and containing threats, usually around the clock. EDR and XDR are things you buy; MDR is people who run them for you.

mTLS — mutual Transport Layer Security

Encrypted communication where both sides prove their identity with a certificate, not just the server. Used between our agents and their control plane.

ROP — Return-Oriented Programming

An exploitation technique that strings together fragments of legitimate code already in memory, so no new malicious code is ever written to disk. Exploit-mitigation controls target the technique rather than any particular payload.

XDR — Extended Detection and Response

EDR widened beyond the endpoint to correlate network, cloud and identity activity in one timeline, so a single attack spanning four systems appears as one story instead of four unrelated alerts.

Security operations

APT — Advanced Persistent Threat

A well-resourced, patient attacker — typically nation-state — targeting a specific organization rather than scanning for easy prey. They will spend months quiet inside a network, which is why detection matters more than prevention against them.

ASN — Autonomous System Number

An identifier for a network operator on the internet. Sign-ins from an unexpected ASN are a common first signal of account compromise.

ATT&CK — Adversarial Tactics, Techniques and Common Knowledge

MITRE's public catalogue of how real attackers behave, organized by technique. We map detections to it so coverage can be measured against reality rather than vendor categories.

DDoS — Distributed Denial of Service

Flooding a system with traffic until it cannot serve legitimate requests. On an industrial network the damage is not downtime of a website — it is operators losing visibility of a live physical process.

IR — Incident Response

The discipline of handling a live security breach: scoping it, containing it, removing the attacker and proving afterwards what happened.

MFA — Multi-Factor Authentication

Requiring more than a password. Phishing-resistant MFA (hardware keys, passkeys) resists attacks that defeat text-message and app codes.

MITRE — MITRE Corporation

A US non-profit that runs federally funded research centres and publishes the ATT&CK framework and the CVE catalogue. Not an acronym in modern use — it is the organization's name.

MSP — Managed Service Provider

A firm that runs IT for other organizations. Compromising one can reach all of its clients.

NAC — Network Access Control

The layer that decides what a device is allowed to reach once it connects. It is what actually moves a compromised machine into a quarantine segment.

RMM — Remote Monitoring and Management

Tools IT providers use to administer client machines remotely. Powerful by design, which makes them a favoured target for attacking many organizations through one supplier.

SIEM — Security Information and Event Management

A system that centralizes logs from across an estate so they can be searched and correlated. The traditional heart of a SOC, and typically its largest cost.

SLA — Service Level Agreement

A contractual promise about response times — how fast we acknowledge, how fast we contain.

SOC — Security Operations Center

The team and facility that monitors security alerts and responds to incidents. Running one 24/7 needs roughly 8–12 analysts, which is why most organizations buy MDR instead.

SOC 2 — Service Organization Control 2

An audit report on how a service provider handles security and availability. Unrelated to a Security Operations Center despite sharing the letters — context decides which is meant.

UTC — Coordinated Universal Time

The global time reference. We schedule follow-the-sun shift handovers in UTC to avoid daylight-saving confusion.

Industrial and OT

BACnet — Building Automation and Control Network

The protocol behind HVAC, lighting and building management. Often overlooked in security programs and routinely the way attackers first get onto a corporate network.

CIP — Common Industrial Protocol

The application layer used by EtherNet/IP in Rockwell-based estates. Note: unrelated to NERC CIP.

DCS — Distributed Control System

Process control concentrated within a single plant, typically continuous processes like refining or chemicals, as opposed to SCADA's geographically spread model.

DNP3 — Distributed Network Protocol 3

The dominant protocol in electric and water utilities. Has an optional security mode (Secure Authentication v5) that is rarely enabled in the field.

EtherNet/IP — EtherNet Industrial Protocol

Rockwell's industrial Ethernet implementation, carrying CIP messages. The IP stands for Industrial Protocol, not Internet Protocol.

GOOSE — Generic Object Oriented Substation Event

A fast substation messaging protocol for protection signalling. Latency-critical, so security controls must not add delay.

HMI — Human-Machine Interface

The operator's screen for a control system. Usually an ordinary Windows computer, which makes it the most attackable component in an otherwise exotic environment.

ICS — Industrial Control System

The broad family of systems that run industrial processes, including SCADA, DCS, PLCs and safety systems. The umbrella term.

IEC — International Electrotechnical Commission

The standards body behind IEC 62443 (industrial security) and IEC 61850 (substation communications).

IEC 61850 — IEC 61850 substation standard

The communication standard for electrical substations, including the GOOSE and MMS protocols.

IEC 62443 — IEC 62443 industrial security standard

The primary international standard for securing industrial automation, built around dividing a plant into zones with controlled conduits between them.

Industroyer — Industroyer / CrashOverride grid malware (2016)

Malware that spoke electrical grid protocols natively, allowing it to open breakers directly rather than relying on stolen operator credentials.

IT — Information Technology

Conventional computing: laptops, servers, email, business applications. Contrasted with OT throughout this site because the two need opposite security assumptions.

MMS — Manufacturing Message Specification

The client-server messaging protocol used within IEC 61850 substation systems.

Modbus — Modbus protocol

A 1979 industrial protocol still in heavy use. It has no authentication whatsoever — anyone who can reach a device can command it, which is why network segmentation carries the security burden.

NERC CIP — North American Electric Reliability Corporation Critical Infrastructure Protection

Mandatory, audited and enforceable security standards for the North American bulk electric system. Non-compliance carries financial penalties.

OT — Operational Technology

Technology that interacts with the physical world — controlling pumps, valves, production lines, building systems. Unlike IT, a failure here can injure someone or stop production, so availability and safety outrank confidentiality.

PLC — Programmable Logic Controller

The small ruggedized computer that physically actuates equipment — opens a valve, starts a motor. Frequently decades old, rarely patchable, and unable to host security software.

PROFINET — Process Field Network

An industrial Ethernet standard common in discrete manufacturing, particularly Siemens estates.

Purdue Model — Purdue Enterprise Reference Architecture

The layered reference model (Levels 0–5) used to describe where industrial systems sit relative to enterprise IT, and therefore where the security boundaries belong.

RTU — Remote Terminal Unit

A field device that collects sensor data and relays it to SCADA, usually at a remote site such as a pumping station or substation.

SCADA — Supervisory Control and Data Acquisition

The supervisory layer of an industrial system — the screens and servers that monitor a process across sites and let operators issue commands. A subset of ICS, often used loosely to mean all of it.

SIS — Safety Instrumented System

The independent system that brings a process to a safe state when something goes wrong. It is kept separate from everything else and is never subject to automated isolation.

SPAN — Switched Port Analyzer

A switch feature that copies network traffic to a monitoring port. Lets us observe an industrial network without injecting anything into it.

Stuxnet — Stuxnet industrial malware (2010)

The first widely known malware built to damage physical equipment. It altered centrifuge controller logic while replaying normal readings to operators, so the control room saw nothing wrong.

TAP — Test Access Point

A hardware device that copies traffic passively. Stronger than SPAN because it cannot transmit — a receive-only optical TAP physically cannot disturb the network it watches.

Networking

API — Application Programming Interface

A defined way for software to talk to other software. We use vendor APIs to push quarantine actions to network equipment.

ARP — Address Resolution Protocol

Maps IP addresses to hardware addresses on a local network. Its cache is volatile evidence worth capturing early in an incident.

DHCP — Dynamic Host Configuration Protocol

Assigns IP addresses to devices automatically as they join a network.

DMZ — Demilitarized Zone

A buffer network between two trust levels. Neither side talks directly to the other; both talk to the DMZ. The standard pattern at an IT/OT boundary.

DNS — Domain Name System

The internet's name-to-address directory. DNS lookups are recorded because malware must resolve its command-and-control domain before it can reach it.

HTTP — Hypertext Transfer Protocol

The web's protocol. Unencrypted HTTP admin interfaces on network hardware are removed during firmware hardening.

HVAC — Heating, Ventilation and Air Conditioning

Building climate systems. Networked, rarely monitored, and a recurring initial access route.

IP — Internet Protocol

The addressing scheme of the internet. An IP address identifies a device on a network.

ISP — Internet Service Provider

The company providing a site's internet connection — and frequently the owner of an unmanaged, never-updated router.

IT/OT boundary — Information Technology / Operational Technology boundary

The dividing line between the business network and the plant network — the single most important control point in an industrial estate.

LAN — Local Area Network

The network within one site or building.

MAC address — Media Access Control address

A network adapter's hardware identifier. Trivially spoofed, which is why we never use it as an identity for access decisions.

NIC — Network Interface Card

A device's network adapter. On a passive sensor we physically disconnect its transmit path so it can only listen.

RDP — Remote Desktop Protocol

Microsoft's remote desktop access protocol. Exposed RDP is one of the most common initial access routes in ransomware incidents.

RF — Radio Frequency

Wireless transmission. Wireless medical devices add an RF attack surface that wired equipment does not have.

SSID — Service Set Identifier

A wireless network's name. Clinical wireless devices are given their own SSID and segment.

TACACS+ — Terminal Access Controller Access-Control System Plus

A protocol for centrally authenticating and auditing administrator logins to network devices, replacing shared local passwords.

TCP — Transmission Control Protocol

The protocol providing reliable, ordered delivery of data, almost always paired with IP.

TCP/IP — Transmission Control Protocol / Internet Protocol

The combined protocol suite that carries most network traffic.

VLAN — Virtual Local Area Network

A logical division of a physical network. Putting a compromised device into a quarantine VLAN is how containment is actually enforced at the network layer.

VRF — Virtual Routing and Forwarding

Separate routing tables on one physical router, creating networks that genuinely cannot reach each other. Used to isolate management traffic from user traffic.

WAF — Web Application Firewall

A filter in front of a web application that blocks known attack patterns. Often the compensating control that makes an unpatched vulnerability non-urgent.

Hardware and software

CPU — Central Processing Unit

A device's main processor. We cap the CPU our agents may consume.

dm-verity — device-mapper verity

A Linux mechanism that verifies a read-only filesystem against a signed hash tree, so any tampering with the image is detected at boot.

EXE / WINWORD.EXE — Executable file / Microsoft Word executable

A runnable program on Windows. WINWORD.EXE is Word itself — named in our worked example because the attack begins with a macro inside a document.

HSM — Hardware Security Module

A hardened appliance for generating and protecting cryptographic keys, used for firmware signing ceremonies.

JTAG/UART — Joint Test Action Group / Universal Asynchronous Receiver-Transmitter

Hardware debug and serial interfaces. Invaluable in development and a direct route in if left enabled on production hardware.

launchd — launch daemon (macOS)

The macOS service manager. Writes to it are a persistence mechanism, so they are treated as security-relevant telemetry.

MB / GB — Megabyte / Gigabyte

Units of data. Used here for agent memory ceilings and telemetry volumes.

OS — Operating System

The base software of a device — Windows, macOS, Linux. Its version and support status decide what security is even possible.

OTP fuses — One-Time Programmable fuses

Hardware bits that can be set exactly once and never reset. Used to permanently store verification keys or disable debug ports.

RAM — Random Access Memory

Working memory. Volatile — its contents are lost at power-off, which is why it is captured first in an incident.

ROM — Read-Only Memory

Memory that cannot be rewritten after manufacture. A boot process anchored in ROM cannot be altered by an attacker who has compromised the software.

RTOS — Real-Time Operating System

A minimal OS guaranteeing response within a fixed time, used in embedded and industrial devices. Usually cannot run conventional security agents.

SBOM — Software Bill of Materials

A complete inventory of every component in a piece of software. Required to answer 'are we affected?' when a vulnerability lands in a widely used library.

SELinux / AppArmor — Security-Enhanced Linux / Application Armor

Linux mandatory access control systems that confine a program to exactly what it needs, so a compromised process cannot roam the system.

SPI flash — Serial Peripheral Interface flash

Rewritable storage where firmware often lives. Keys stored here are not a hardware root of trust, because an attacker who can write to it can replace them.

systemd — system daemon (Linux)

The Linux service manager. As with launchd, unit-file writes are a persistence mechanism worth recording.

TPM — Trusted Platform Module

A dedicated security chip that stores cryptographic keys in hardware where software cannot extract or rewrite them. One way to anchor a root of trust.

USB — Universal Serial Bus

The standard port for removable media. On genuinely segmented industrial networks USB becomes the primary transfer mechanism, and therefore the primary infection path.

VDI — Virtual Desktop Infrastructure

Desktops that run in a data centre and are streamed to the user. Useful for compliance because the sensitive data never lands on the endpoint.

Compliance

C3PAO — CMMC Third-Party Assessment Organization

The accredited body that performs a CMMC assessment and awards certification. A consultant cannot certify their own work — these roles must be independent.

CCoP — Cybersecurity Code of Practice

Singapore's mandatory code for operators of Critical Information Infrastructure, with prescriptive OT requirements.

CDE — Cardholder Data Environment

The systems that store, process or transmit payment card data. Everything able to reach it falls into PCI DSS scope.

CII — Critical Information Infrastructure

Systems whose loss would damage national security, economy or public health. A defined legal category in Singapore and several other jurisdictions.

CMMC — Cybersecurity Maturity Model Certification

The US Department of Defense program requiring its suppliers to prove their cybersecurity, verified by an independent assessor. Level 2 is the common requirement for handling CUI.

CMVP — Cryptographic Module Validation Program

The NIST program that issues and lists FIPS 140-3 validations. If a module is not on the CMVP list, it is not validated.

CUI — Controlled Unclassified Information

US government information that is sensitive but not classified — technical drawings, specifications, contract data. Its presence is what pulls a system into CMMC scope.

CVE — Common Vulnerabilities and Exposures

The public catalogue giving each known vulnerability a unique identifier.

CVSS — Common Vulnerability Scoring System

A 0–10 severity score for a vulnerability in the abstract. It knows nothing about your network, which is why we rank by reachability instead.

Cyber Essentials — UK Cyber Essentials and Cyber Essentials Plus

A UK government-backed baseline of five technical controls. The Plus tier is independently verified and is frequently required for public-sector contracts.

DHA — Defense Health Agency

The US agency running military health systems, adding its own device security requirements on top of FDA expectations.

DIB — Defense Industrial Base

The companies that supply the US Department of Defense — roughly 300,000 organizations, from primes down to small machine shops. CMMC applies across it.

DIBCAC — Defense Industrial Base Cybersecurity Assessment Center

The government body that performs CMMC Level 3 assessments directly, rather than delegating them to a third-party assessor.

DoD — United States Department of Defense

The US military department. It mandates CMMC across its supply chain and enforces it through the contract itself.

DORA — Digital Operational Resilience Act

EU regulation for financial entities and their technology suppliers, mandating resilience testing, a third-party register and documented exit plans.

Essential Eight — Australian Essential Eight mitigation strategies

Eight prioritized controls from the Australian Signals Directorate, each assessed at a maturity level rather than simply present or absent.

FCI — Federal Contract Information

Information provided by or generated for the government under a contract and not intended for public release — schedules, process documents, correspondence. Holding only FCI puts you at CMMC Level 1 with an annual self-assessment.

FDA — Food and Drug Administration

The US regulator for medical devices, setting both premarket security expectations and post-market vulnerability disclosure duties for manufacturers.

FIPS — Federal Information Processing Standards

US government standards for federal systems. FIPS 140-3 governs cryptographic module validation.

FIPS 140-3 — Security Requirements for Cryptographic Modules

Validates a specific cryptographic module — one version of one library on one platform — not your product or your company. 'FIPS validated' has a certificate number; 'FIPS compliant' means nothing.

GDPR — General Data Protection Regulation

The EU and UK data protection law. Relevant here because endpoint telemetry — usernames, hostnames, file paths — is personal data, so retention and cross-border transfer must be designed in.

HIPAA — Health Insurance Portability and Accountability Act

The US law governing protected health information. Its Security Rule sets the safeguards hospitals must demonstrate.

ICT — Information and Communications Technology

The term European regulation uses for what US documents call IT. DORA governs 'ICT third-party providers'.

IRAP — Infosec Registered Assessors Program

The Australian scheme under which endorsed assessors evaluate systems against the ISM. Usually carries onshore data residency expectations.

ISM — Information Security Manual

The Australian Signals Directorate's control catalogue for government systems, assessed via IRAP.

ISMS — Information Security Management System

The documented set of policies, processes and controls that ISO 27001 certifies.

ISO — International Organization for Standardization

The global standards body behind ISO/IEC 27001.

ISO/IEC 27001 — Information security management systems standard

The international certifiable standard for running an information security program. The common spine most other regimes can be derived from.

Joint Security Plan — Joint Security Plan for medical devices

An industry framework dividing security responsibility between device manufacturers and healthcare providers.

LGPD — Lei Geral de Proteção de Dados

Brazil's general data protection law, closely modelled on GDPR with local reporting specifics.

MAS TRM — Monetary Authority of Singapore Technology Risk Management guidelines

Singapore's regulatory expectations for technology risk in financial institutions.

MDS2 — Manufacturer Disclosure Statement for Medical Device Security

The standard form on which a manufacturer declares a device's security characteristics. We reconcile it against what the device is observed doing — the gap is often the finding.

NIS2 — Network and Information Security Directive 2

EU legislation imposing security and incident-reporting duties on essential and important entities, with an early-warning report due within 24 hours and personal accountability for management.

NIST — National Institute of Standards and Technology

The US agency that publishes the security standards most of this site refers to.

NIST SP 800-171 — Protecting CUI in Nonfederal Systems

The 110 security controls a contractor must implement to handle CUI. The technical foundation underneath CMMC Level 2.

NIST SP 800-172 — Enhanced Security Requirements for Protecting CUI

Additional controls layered on top of SP 800-171 for the most critical programs, designed on the assumption that a capable adversary will get in. The basis of CMMC Level 3.

NIST SP 800-82 — Guide to Operational Technology Security

NIST's guidance for securing industrial control systems, written around OT's constraints rather than IT's.

PCI DSS — Payment Card Industry Data Security Standard

The card industry's security standard. Network segmentation reduces its scope, and it requires that segmentation be proven by penetration testing.

POA&M — Plan of Action and Milestones

A formal record of unmet controls with dated remediation commitments. A commitment with a deadline, not a parking space.

SP — Special Publication

NIST's document series. SP 800-171 covers protecting CUI; SP 800-82 covers industrial control system security.

SSP — System Security Plan

The document describing your system boundary and how each control is implemented. The first thing an assessor reads.

Markets

AI — Artificial Intelligence

Used on this site specifically for machine-learning models that classify behavior, not for general-purpose chat systems.

AMER — The Americas

North, Central and South America combined — NAM plus LATAM.

ANZ — Australia and New Zealand

Named separately from APAC where local frameworks such as the Essential Eight or IRAP apply.

AP — Asia-Pacific

A shorter form of APAC, used interchangeably.

APAC — Asia-Pacific

Asia together with Oceania and the Pacific.

CEE — Central and Eastern Europe

Poland, Czechia, Hungary, Romania and neighbouring markets.

CFO — Chief Financial Officer

Named in our incident example because capital approval and wire recall are finance decisions, not technical ones.

DACH — Germany, Austria, Switzerland

From the country codes Deutschland, Austria, Confoederatio Helvetica — the German-speaking European market.

ECG — Electrocardiogram

Heart monitoring equipment — an example of a patient-connected diagnostic device.

EMEA — Europe, the Middle East and Africa

One of the three super-regions we serve.

ERP — Enterprise Resource Planning

Core business software for finance, supply chain and manufacturing.

EU / UK / US / AU — European Union / United Kingdom / United States / Australia

Jurisdictions referenced in the compliance sections.

FL — Florida

Our headquarters state — Clearwater, Florida.

LATAM — Latin America

Latin America and the Caribbean — Mexico, Brazil, Chile, Colombia, Argentina and the Caribbean nations.

LIS — Laboratory Information System

The system managing laboratory orders and results. Lab analyzers are segmented to reach only this.

ML — Machine Learning

Statistical models trained on examples rather than programmed with explicit rules. The basis of behavioral detection.

NA — North America

A shorter form of NAM, used interchangeably.

NAM — North America

United States and Canada.

P1–P4 — Priority 1 to Priority 4

Our vulnerability priority bands, derived from reachability and exploitability rather than CVSS.

PACS — Picture Archiving and Communication System

The hospital system that stores and distributes medical images. Imaging devices are segmented to reach only this.

RSS — Really Simple Syndication

A feed format. Named in our incident example because attackers hide stolen replies in the rarely opened RSS Subscriptions mail folder.

SMB — Small and Medium-sized Business

Organizations facing the same adversaries as large enterprises without the staffing. Note: in a networking context SMB means Server Message Block — on this site it always means the business segment.

UAE — United Arab Emirates

A Middle East market within EMEA.