Acronym & professional vocabulary

Prove who you are, decide what you may do, and record what you did.

Granting access based on attributes (department, location, device, time) rather than only role.

A list of rules saying who or what may access a resource and how.

A defined way for software components to talk to each other.

A skilled, well-resourced attacker who aims to stay hidden for a long time.

Maps an IP address to a hardware (MAC) address on a local network.

A public knowledge base of real-world attacker tactics and techniques.

A plan to keep essential operations running during a disruption.

A scam where an attacker poses as an executive or vendor to redirect money or data.

The three goals of security: keep data private, keep it accurate, and keep it reachable.

A nonprofit that publishes the CIS Controls and CIS Benchmarks.

The U.S. federal agency that leads national cyber defense and issues advisories.

Tricking a logged-in user's browser into making an unwanted action.

A public catalog that gives each known vulnerability a unique ID.

A 0–10 scoring method for how severe a vulnerability is.

A catalog of the underlying weakness types that lead to vulnerabilities.

Testing a running application from the outside for flaws.

A control system spread across a plant to manage complex, continuous processes.

A DoS launched from many machines at once, often a botnet.

The service that automatically hands devices their network settings.

Controls that detect and block sensitive data from leaving where it should stay.

The internet's phone book — it turns names like example.com into IP addresses.

An attack that makes a system unavailable by overwhelming or crashing it.

The subset of continuity focused on restoring IT systems and data.

Software on laptops/servers that detects, investigates, and contains threats on the device.

The point when a product is no longer sold or supported at all.

The point when a vendor stops providing patches or help, even if the product still runs.

Business software that ties together finance, HR, supply chain, and more.

The discipline of running security as a managed, accountable, rule-following program.

A U.S. law with a Security Rule that protects electronic health information.

The screen operators use to watch and control an industrial process.

A tamper-resistant device that safely stores and uses cryptographic keys.

Information gathered directly from people.

The systems and rules that manage user identities and what they can access.

The broad family of systems that run industrial processes.

A sensor that watches traffic or hosts and alerts on suspected attacks.

A global standards body for electrical and electronic systems, co-author of 62443.

Connected sensors and devices used in industrial settings.

A clue that a system may be breached — a bad IP, file hash, or domain.

The addressing and routing scheme that gets packets from source to destination.

Like an IDS, but it can actively block the traffic it flags.

A professional body that co-develops the ISA/IEC 62443 OT-security series.

A global body that publishes management-system standards, including for security.

Computing focused on data — email, files, business applications.

A hardware address burned into a network interface.

Software that manages and tracks production on the factory floor.

Requiring two or more different proofs of identity, such as a password plus a phone code.

The average time to notice an incident after it starts.

The average time to contain or fully recover from an incident.

Technology that checks a device's identity/health before letting it on the network.

Lets many devices share one public IP by rewriting addresses at the gateway.

Mandatory cybersecurity standards for the North American bulk electric system.

A U.S. agency that publishes widely used cybersecurity frameworks and guidance.

The company that originally made a product or component.

Information gathered from public sources.

Computing that monitors and controls physical processes and equipment.

A nonprofit that publishes free application-security guidance, including the Top 10.

Extra controls over powerful admin accounts — vaulting, check-out, and session recording.

A security standard for organizations that handle payment-card data.

The system of certificates and keys that lets parties trust each other online.

A rugged industrial computer that controls machinery and processes.

A layered model for separating IT and OT networks into levels.

Malware that gives an attacker hidden remote control of a device.

Granting access by job role rather than to each person individually.

A flaw that lets an attacker run their own code on a system over the network.

NIST's seven-step process for managing system security and privacy risk.

The maximum acceptable amount of data loss, measured in time.

The target time to restore a system after an outage.

A field device that collects data and relays control commands, often over distance.

Analyzing source code for flaws without running it.

A list of all components and dependencies inside a piece of software.

Checking third-party and open-source components for known vulnerabilities and licenses.

Systems that monitor and control equipment across wide areas.

The stages of building software, from idea to retirement.

A platform that collects logs from across an environment and alerts on suspicious patterns.

An independent system that brings a process to a safe state when danger is detected.

Tools that automate routine response steps and tie security tools together.

The team (and room/tooling) that monitors and responds to security events.

An audit report on how a service provider protects customer data.

Injecting database commands through an app's input to read or alter data.

An SDLC with security built into every stage.

An encrypted way to log in to and control a remote computer.

Signing in once to reach many applications.

A reliable, ordered way to send data across a network, with delivery confirmation.

The protocol that encrypts data in transit between systems.

The behavior patterns of an attacker — what they aim to do and how.

A fast, connectionless way to send data without delivery guarantees.

A way to split one physical network into separate logical segments.

An encrypted tunnel that connects a user or site securely over an untrusted network.

EDR expanded to correlate signals across endpoint, network, email, and cloud.

A web flaw that lets an attacker run scripts in another user's browser.