IT and security glossary
277 terms defined in plain English, written by the engineers who work with them rather than lifted from a vendor datasheet. Every definition says what the thing is, why it matters, and what it connects to. No sign-up, no gate.
Browse by subject
Cybersecurity and threats
61How attacks actually work, and the controls that stop them.
Identity and access
39Accounts, authentication, and who can reach what. The most attacked layer in most businesses.
Microsoft 365 and cloud
38The platform most businesses run on, and the licensing and security decisions inside it.
Networks and infrastructure
42Firewalls, switches, wireless, and the plumbing everything else depends on.
Compliance and frameworks
35HIPAA, PCI, SOC 2, NIST, CMMC, and the evidence work behind them.
Backup and disaster recovery
26Getting the business back after hardware fails, someone deletes the wrong thing, or you are encrypted.
Penetration testing
36Offensive security: how testing is scoped, what the findings mean, and how vulnerabilities are rated.
#
3-2-1 rule Keep three copies of data on two different media, with one copy offsite. 300-seat cap Microsoft's limit of 300 licensed users across the entire Microsoft 365 Business plan family within one tenant. 802.1X A standard requiring devices to authenticate before they are granted access to a wired or wireless network.
A
Acceptable use policy The rules governing how staff may use company systems, devices, and data. Access review A periodic check that everyone who holds access to something still needs it. Active Directory Microsoft's on-premises directory service, running on domain controllers and governing Windows domain authentication. Air-gapped backup A backup copy kept physically or logically disconnected, unreachable from the production network. Application allowlisting Permitting only approved software to run, and blocking everything else by default. Attack surface Everything about your organization that an attacker could potentially reach and attempt to exploit. Attestation A formal statement that specified requirements have been met, signed by someone accountable for its accuracy. Audit evidence The records that demonstrate a control was actually operating, not merely defined. Audit log A record of who did what, when, in a system, retained so it can be reviewed later.
B
Backup A separate copy of data kept so it can be restored after loss, corruption, deletion, or encryption. Backup window The period available for backups to run without affecting normal operations. Bandwidth The maximum rate at which data can move across a connection. Bare metal restore Recovering an entire system, including operating system and configuration, onto hardware with nothing on it. Beaconing The regular check-in traffic a compromised machine sends to its command and control server. Blue team The defenders: the people responsible for detecting, investigating, and responding to attacks. Breach notification The legal obligation to inform regulators and affected individuals after a data breach, usually within a defined deadline. Break-glass account A highly privileged account excluded from conditional access, kept for emergencies when normal administrative access fails. Brute force attack Trying large numbers of passwords against an account until one works. Buffer overflow Writing more data into a memory buffer than it can hold, corrupting adjacent memory and potentially executing attacker-supplied code. Business associate agreement A contract required under HIPAA between a covered entity and any vendor that handles protected health information on its behalf. Business continuity plan The plan for keeping essential business functions running during and after a disruption. Business email compromise Fraud carried out through a real or convincingly spoofed business mailbox, usually to redirect a payment. Business impact analysis An assessment of which business functions matter most and what it costs when each is unavailable. BYOD Allowing staff to access company systems from personal phones and computers.
C
Cardholder data The payment card information PCI DSS is designed to protect, chiefly the primary account number. Cloud backup Backing up data to a cloud provider rather than to local hardware. Cloud migration Moving systems and data from on-premises infrastructure to cloud services. Cloud Solution Provider Microsoft's partner channel for selling and managing licensing, where the partner bills the customer rather than Microsoft. CMMC The Department of Defense programme that verifies contractors meet required cybersecurity practices before award. Command and control The channel a compromised machine uses to receive instructions from the attacker. Compensating control An alternative safeguard used when a required control cannot be implemented, providing comparable protection. Conditional access Policies that decide whether to allow, block, or add requirements to a sign-in based on the context of the request. Consent phishing Tricking a user into approving a malicious application's access to their account data. Containment Stopping an incident from spreading further while you work out what happened. Controlled unclassified information Government information that is not classified but still requires protection under law or policy. Credential stuffing Using username and password pairs stolen from one breach to log into unrelated services. Cross-site request forgery Tricking an authenticated user's browser into submitting an action they did not intend. Cross-site scripting Injecting script into a web page that then executes in another user's browser in the context of that site. CVE A unique public identifier assigned to a specific known vulnerability. CVSS A standard scoring system rating vulnerability severity from 0 to 10 based on exploitability and impact. CWE A classification of the underlying types of software weakness, describing categories rather than specific instances. Cyber insurance Insurance covering losses from security incidents, including response costs, business interruption, and liability.
D
Data classification Sorting data into categories by sensitivity so that protection can be applied proportionately. Data exfiltration Copying data out of your environment to somewhere the attacker controls. Data loss prevention Policies that detect sensitive data in transit and block, warn, or log when it moves somewhere it should not. Deduplication Storing only one copy of repeated data blocks to reduce backup storage consumption. Deep packet inspection Examining the contents of network traffic, including decrypting HTTPS, rather than just the addressing information. Default credentials The factory username and password a device or application ships with, unchanged after installation. Defense in depth Layering multiple independent controls so that one failure does not become a breach. Denial of service Overwhelming a system with traffic or requests so legitimate users cannot reach it. Device compliance A policy defining what makes a device acceptable, used as a condition for granting access. DHCP The service that automatically assigns IP addresses and network settings to devices when they connect. Digital forensics Collecting and analyzing evidence from affected systems to establish what an attacker did and what they reached. Disaster recovery The process and capability for restoring IT systems after a major failure or destructive event. DKIM A cryptographic signature added to outbound email that proves the message came from your domain and was not altered. DMARC A DNS policy that tells receiving servers what to do with mail claiming to be from your domain that fails SPF and DKIM. DMZ A separate network zone for systems that must be reachable from the internet, isolated from the internal network. DNS The system that translates names like desertlakes.io into the IP addresses computers actually connect to. DNS filtering Blocking access to malicious or unwanted destinations at the point where a name is looked up. Domain controller A server that holds the Active Directory database and authenticates users and computers in the domain. Double extortion A ransomware tactic where the attacker steals your data before encrypting it, then threatens to publish it if you refuse to pay. DR site A secondary location where systems can run if the primary site becomes unavailable. Dwell time How long an attacker is inside your environment before they are detected.
E
eDiscovery Searching, preserving, and exporting electronic content in response to a legal, regulatory, or investigative request. Email security The layer that inspects inbound and outbound mail for phishing, malware, impersonation, and data leakage. Endpoint detection and response Security software on each device that records behavior, detects attacker activity, and lets a responder investigate and isolate remotely. Endpoint protection platform The preventive layer on a device: antivirus, exploit mitigation, and policy enforcement that blocks threats before they run. Entra ID P2 The premium Entra licensing tier, adding Identity Protection, Privileged Identity Management, and access reviews. Enumeration Systematically listing what exists on a target: services, users, shares, and configurations. Exchange Online The hosted email service in Microsoft 365, covering mailboxes, mail flow, and message-level security. Exploit Code or a technique that takes advantage of a vulnerability to make a system do something unintended. Exploitation Using a discovered weakness to gain access or execute code on a target. Exposed service A system or application reachable from the internet that should not be, or should not be reachable without authentication. Extended detection and response Detection that correlates signals across endpoints, identity, email, and cloud rather than looking at each in isolation. External penetration test Testing performed from the internet against everything you expose publicly.
F
Failback Returning operations to the primary system after running on a standby. Failover Switching operation to a standby system when the primary one fails. False positive A reported finding that turns out not to be a genuine issue in your environment. FIDO2 An open authentication standard using public key cryptography, implemented by security keys and passkeys. Firewall A device or service that controls which traffic is allowed between networks based on a set of rules. Full backup A complete copy of all selected data, independent of any other backup.
G
Gap assessment A comparison of current practice against a target framework, producing a prioritized list of what is missing. GDPR European regulation governing the processing of personal data, with extraterritorial reach and substantial penalties. Guest account An external person given access to your tenant using their own organization's identity. Guest network A wireless network for visitors that provides internet access without any route into internal systems.
I
Identity and access management The discipline of controlling who has an account, how they prove it, and what they are allowed to reach. Identity Protection Microsoft's risk engine for Entra ID, scoring sign-ins and users as risky based on behavior and known threat signals. Immutable backup A backup that cannot be modified or deleted for a defined period, even by an administrator. Incident response The structured process of detecting, containing, eradicating, and recovering from a security incident. Incident response plan The documented procedure for handling a security incident, including roles, decision authority, and contacts. Incremental backup A backup capturing only what changed since the previous backup. Indicator of compromise A specific, observable artifact suggesting a system has been breached, such as a file hash, domain, or unusual account behavior. Infostealer Malware that harvests saved passwords, browser cookies, and session tokens from a machine and sends them to the operator. Infrastructure as a service Renting virtual servers, storage, and networking from a cloud provider while retaining responsibility for the operating system upward. Initial access broker A criminal specialist who breaks into organizations and sells that access to others, such as ransomware crews. Insecure direct object reference Accessing another user's data by changing an identifier in a request, because the application does not check authorization. Insider Risk Management Purview capability that detects risky user behavior, such as mass downloads shortly before someone resigns. Insider threat Risk originating from someone who already has legitimate access: an employee, contractor, or partner. Internal penetration test Testing from inside the network, simulating an attacker who has already gained a foothold. Intrusion prevention system A control that watches network traffic for attack patterns and blocks or alerts when it sees them. IPsec A protocol suite for encrypting and authenticating IP traffic, most often used for site-to-site VPN tunnels. ISO 27001 An international standard for an information security management system, with certification issued by an accredited body.
L
Latency The delay between sending data and it arriving, usually measured as a round trip in milliseconds. Lateral movement The stage where an attacker moves from the machine they first landed on toward the systems they actually want. LDAP The protocol applications use to query a directory such as Active Directory for users, groups, and attributes. Leak site A site run by a ransomware crew where they name victims and publish stolen data to pressure them into paying. Least privilege Giving every account only the access it needs to do its job, and nothing beyond that. Legacy authentication Older sign-in protocols that cannot support MFA, and are therefore a standing bypass of it. Litigation hold Preserving all of a user's content indefinitely because it may be relevant to legal proceedings. Living off the land Attacker technique of using the legitimate tools already installed on a system instead of bringing their own malware. Local administrator rights Full control over a single computer, which is enough for most malware to do everything it needs.
M
Malicious inbox rule A mail rule an attacker creates in a compromised mailbox to hide their activity from the real owner. Malware Any software written to do something harmful on a system it has reached, from stealing data to encrypting it. Man-in-the-middle attack Intercepting communication between two parties so the attacker can read or alter it while both sides believe the connection is direct. Managed detection and response A service where an outside team watches your security alerts around the clock and responds to real threats on your behalf. Mean time to detect The average time between a security event starting and someone noticing it. Mean time to recovery The average time taken to restore service after a failure. MFA fatigue Spamming a user with approval prompts until they approve one just to make it stop. Microsoft 365 Microsoft's subscription bundle of Office applications, email, file storage, collaboration, identity, and security services. Microsoft 365 Business Premium The top small-business Microsoft 365 plan, bundling Office apps with device management and a real security stack, capped at 300 seats. Microsoft 365 Copilot Microsoft's AI assistant inside the Office applications, drawing on the content the signed-in user can already access. Microsoft 365 E3 The mid-tier enterprise plan: Office, Windows Enterprise, and Intune with no seat cap, but without the advanced security stack. Microsoft 365 E5 The top enterprise plan, bundling everything in E3 plus the full Defender security stack, advanced Purview compliance, Power BI Pro, and Teams Phone. Microsoft Azure Microsoft's cloud platform for hosting servers, applications, databases, and infrastructure services. Microsoft Defender for Cloud Apps A cloud access security broker that discovers which SaaS applications are in use and controls how company data moves through them. Microsoft Defender for Endpoint Microsoft's enterprise EDR product, providing behavioral detection, investigation, and remote response on managed devices. Microsoft Defender for Identity Detection for on-premises Active Directory, watching domain controllers for attacker behavior. Microsoft Defender for Office 365 Microsoft's email and collaboration security layer, protecting against phishing, malicious links, and weaponized attachments. Microsoft Defender Suite Microsoft's bundled security add-on: Entra ID P2, Defender for Endpoint P2, Defender for Office P2, Defender for Identity, and Defender for Cloud Apps. Microsoft Entra ID Microsoft's cloud identity service, the account directory behind Microsoft 365 and thousands of connected applications. Microsoft Intune Microsoft's cloud service for managing and securing laptops, phones, and tablets. Microsoft Purview Microsoft's data governance and compliance platform: classification, labeling, data loss prevention, retention, eDiscovery, and insider risk. Microsoft Purview Suite Microsoft's bundled compliance add-on: advanced data loss prevention, insider risk, communication compliance, records management, and premium eDiscovery and audit. Microsoft Secure Score A numeric measure of your Microsoft 365 security configuration against Microsoft's recommended settings. Microsoft Teams Microsoft's chat, meeting, and collaboration application, layered over SharePoint, Exchange, and Entra ID. Misconfiguration A system that is insecure because of how it was set up, rather than because of a flaw in the software. Mobile device management Managing the configuration and security of phones and tablets that access company data. Multi-factor authentication Requiring two or more different kinds of proof to sign in, so a stolen password alone is not enough.
N
NAT Translating private internal IP addresses to a public one so many devices can share a single internet address. Network monitoring Continuously checking that devices, links, and services are up and performing as expected. Network segmentation Dividing a network into zones with controlled traffic between them, so a compromise in one does not reach the others. Network switch The device that connects wired equipment within a site and forwards traffic between them. Next-generation firewall A firewall that inspects traffic by application and content rather than only by port and address. NIST Cybersecurity Framework A voluntary framework organizing security work into functions: govern, identify, protect, detect, respond, and recover. NIST SP 800-171 A set of 110 security requirements for protecting controlled unclassified information in non-federal systems.
O
OAuth A standard for granting an application limited access to your data in another service without giving it your password. Offboarding Removing every piece of access a departing person holds, on the day they leave. Offsite backup A backup copy kept at a different physical location from the systems it protects. OneDrive for Business Per-user cloud file storage in Microsoft 365, synced to devices and backed by SharePoint. OpenID Connect A modern identity layer built on OAuth 2.0, used for signing in to web and mobile applications. Oversharing Files and sites shared far more broadly than intended, usually through links that grant access to anyone in the organization. OWASP Top 10 A widely referenced list of the most critical web application security risks, updated periodically.
P
Packet loss Data that never arrives at its destination and has to be retransmitted, or is simply lost. Pass the hash Authenticating as a user with the stored hash of their password rather than the password itself. Passkey A FIDO2 credential stored on a phone or computer and synced through the platform, replacing a password entirely. Password manager Software that generates, stores, and fills unique passwords so people do not have to remember or reuse them. Password policy The rules governing password length, complexity, reuse, and expiry. Password spraying Trying one common password against many accounts, rather than many passwords against one account. Passwordless authentication Signing in without a password at all, using a device, biometric, or security key instead. Patch management The ongoing process of finding, testing, and applying software updates across every system you run. Patch Tuesday The second Tuesday of each month, when Microsoft releases its scheduled security updates. PCI DSS The security standard any organization handling payment card data must meet, set by the card brands. Penetration test An authorized simulated attack against your systems to find and demonstrate exploitable weaknesses before a real attacker does. Penetration testing requirement The obligation in several frameworks and insurance policies to have security testing performed periodically by an independent party. Personally identifiable information Any data that can identify a specific person, either alone or combined with other available information. Phishing A fraudulent message designed to trick someone into handing over credentials, approving a login, or opening something malicious. Phishing simulation A controlled fake phishing campaign sent to your own staff to measure and improve how they respond. Phishing-resistant MFA Authentication methods that cannot be relayed by a fake login page, because the credential is bound to the real site. Pivoting Using a compromised system as a route to reach networks that are not directly accessible. Plan of action and milestones A documented plan for closing known compliance gaps, with owners and target dates. Platform as a service Renting a managed runtime for your application, with the provider handling the operating system and platform underneath. Port forwarding A firewall rule directing inbound traffic on a given port to a specific internal device. Post-exploitation What a tester or attacker does after gaining initial access: gathering credentials, escalating, and moving toward the objective. Power over Ethernet Delivering electrical power to devices over the same cable that carries their network connection. Pretexting Inventing a believable scenario and identity to make a target comfortable handing something over. Privilege escalation Gaining a higher level of access than you started with, such as moving from a standard user to an administrator. Privileged access management Controlling, monitoring, and recording the use of accounts that hold elevated rights. Privileged Identity Management Making administrative roles available on request and for a limited time, rather than assigned permanently. Professional services automation The ticketing, scheduling, and billing system an IT services business runs on. Proof of concept A demonstration that a vulnerability is genuinely exploitable, rather than theoretically present. Protected health information Health information that can be tied to an individual, in any form, held by a covered entity or its business associates. Purple team A collaborative exercise where attackers and defenders work together, testing detection technique by technique.
R
RADIUS A protocol that centralizes authentication for network access, used by wireless, VPN, and switch port control. Ransomware Malware that encrypts your files and demands payment for the key, now almost always combined with stealing the data first. Reconnaissance Gathering information about a target before attempting anything against it. Recovery point objective The maximum amount of data, measured in time, you can afford to lose. Recovery time objective The maximum time a system can be unavailable before the impact becomes unacceptable. Red team An adversarial exercise testing whether your detection and response can catch a determined attacker pursuing a specific objective. Remediation Fixing the issues a test identified, in priority order. Remote code execution A vulnerability allowing an attacker to run their own commands on a system across the network. Remote monitoring and management The platform an IT team uses to monitor, patch, script, and remotely support the devices it manages. Replication Continuously copying data or entire systems to a second location so a current copy is always available. Restore test Actually recovering data from backup to verify the backup works and the process is understood. Retention policy A rule defining how long content is kept and what happens when that period ends. Retention schedule A documented statement of how long each category of record is kept before disposal. Retest Verifying that findings from a previous test have actually been fixed. Risk assessment A structured evaluation of what could go wrong, how likely it is, what it would cost, and what you will do about it. Risk rating The severity assigned to a finding, ideally accounting for your environment rather than the raw score alone. Role-based access control Granting permissions to roles rather than individuals, and assigning people to roles. Rules of engagement The agreed conditions for a security test: timing, permitted techniques, escalation contacts, and stop conditions.
S
SaaS backup Independent backup of data held in cloud applications such as Microsoft 365, Google Workspace, or Salesforce. SAML An XML-based standard that lets an identity provider vouch for a user to an application, enabling single sign-on. Sandboxing Opening a suspicious file in an isolated environment to watch what it does before letting it near a real system. SCIM A standard for automatically creating, updating, and deactivating user accounts across connected applications. Scope The explicit definition of what a security test may target and what is off limits. SD-WAN Software-defined wide area networking, which manages multiple internet links intelligently across sites. Security awareness training Ongoing education that teaches staff to recognize and report attacks aimed at them. Security control A specific safeguard put in place to reduce risk, whether technical, administrative, or physical. Security operations centre The team and tooling responsible for monitoring, investigating, and responding to security events. Security policy The written statement of what your organization requires regarding security, and who is responsible for what. Sensitivity label A tag applied to a document or email that carries protection with it, such as encryption or access restrictions. Server-side request forgery Making an application fetch a URL of the attacker's choosing, reaching systems they could not access directly. Service account A non-human account used by an application or automated process to authenticate. Service level agreement A contractual commitment to defined levels of availability or response, usually with a remedy when they are missed. Shadow IT Software and services staff adopt on their own, without IT approval or oversight. Shared responsibility model The division of security duties between a cloud provider and its customer, which shifts depending on the service type. SharePoint Online The document storage and collaboration platform behind Teams files and company document libraries. Shodan A search engine that continuously indexes internet-connected devices and the services they expose. SIEM A system that collects logs from across your environment, correlates them, and raises alerts on suspicious patterns. Single sign-on Signing in once to an identity provider and reaching many applications without authenticating again to each. Snapshot A point-in-time image of a system or volume, allowing a quick return to that exact state. SNMP A protocol network devices use to report their status and statistics to a monitoring system. SOAR Tooling that automates the repetitive parts of responding to an alert, such as isolating a device or disabling an account. SOC 2 An audit report on how a service organization controls customer data, assessed against the Trust Services Criteria. SOC 2 Type 2 The version of a SOC 2 report that tests whether controls actually worked over a defined observation period. Social engineering Manipulating people rather than technology to gain access, information, or a fraudulent payment. Social engineering assessment Authorized testing of how staff respond to phishing, phone pretexts, or physical entry attempts. Software as a service Subscribing to software the vendor runs entirely, accessed through a browser or app. Spear phishing A phishing attack aimed at one specific person, written using real details about them to make it credible. SPF A DNS record listing which servers are permitted to send email for your domain. SPRS score A self-assessed score from -203 to 110 reflecting how many NIST SP 800-171 requirements a contractor meets. SQL injection Manipulating an application's database query by supplying input the application fails to handle safely. SSID The name of a wireless network, as it appears in the list of available networks. SSL VPN Remote access VPN carried over TLS, usually through a browser or a lightweight client. Subnet A defined range of IP addresses forming one logical network segment. Supply chain attack Compromising a vendor, tool, or software update in order to reach that vendor's customers. Syslog A standard for devices to send log messages to a central collector.
T
Tabletop exercise A discussion-based rehearsal where a team walks through their response to a realistic scenario. Teams Phone Microsoft's calling capability that turns Teams into a business phone system with real phone numbers. Tenant Your organization's dedicated instance of a cloud service, containing your users, data, and configuration. Tenant-to-tenant migration Moving users, mail, files, and Teams content from one Microsoft 365 tenant into another. Third-party patching Updating the non-Microsoft software on your machines, which is where a large share of exploited vulnerabilities live. Threat hunting Proactively searching your environment for attacker activity that has not triggered any alert. Threat intelligence Information about who is attacking, what tools they use, and what to look for, applied to your own defenses. Tiered administration Separating administrative accounts by the sensitivity of what they manage, so high-value credentials never touch low-trust machines. TLS certificate A cryptographic credential that proves a server is who it claims to be and enables encrypted connections. Token theft Stealing the session token issued after a successful login, letting an attacker resume the session without credentials or MFA. Trust Services Criteria The five categories a SOC 2 report can cover: security, availability, processing integrity, confidentiality, and privacy.
V
Vendor risk management Assessing and monitoring the security of suppliers who handle your data or connect to your systems. Versioning Retaining previous versions of a file so earlier states can be recovered. Vishing Social engineering carried out over a phone call, increasingly using AI-generated voice. VLAN A logical network created on shared physical switching, keeping groups of devices separated from each other. Volume Shadow Copy A Windows feature keeping previous versions of files on a volume so users can recover them without help. VPN An encrypted tunnel that connects a remote user or site to a network as though they were locally attached. Vulnerability A weakness in software, configuration, or process that an attacker could use to do something they should not be able to do. Vulnerability scan An automated check of systems against a database of known vulnerabilities and misconfigurations.
W
Warm site A recovery location with hardware and connectivity in place but requiring data restoration and startup before use. Web application penetration test Testing focused on a specific application, its logic, authentication, and handling of user input. Whaling Spear phishing aimed at senior executives, where a single success unlocks unusually high authority. Windows Autopilot Microsoft's zero-touch deployment service that configures a new Windows device automatically the first time it is switched on. Wireless access point The device that provides wireless network coverage and bridges wireless clients onto the wired network. Wireless site survey Measuring the physical space to determine where access points should go and at what power. WPA3 The current wireless security standard, improving on WPA2 with stronger authentication and protection for open networks.
Cybersecurity and threats
How attacks actually work, and the controls that stop them.
Application allowlistingAttack surfaceBeaconingBrute force attackBusiness email compromiseCommand and controlContainmentCredential stuffingData exfiltrationDefense in depthDenial of serviceDigital forensicsDNS filteringDouble extortionDwell timeEmail securityEndpoint detection and responseEndpoint protection platformExploitExtended detection and responseHelp desk verificationIncident responseIndicator of compromiseInfostealerInitial access brokerInsider threatLateral movementLeak siteLeast privilegeLiving off the landLocal administrator rightsMalicious inbox ruleMalwareMan-in-the-middle attackManaged detection and responseMean time to detectPass the hashPassword sprayingPatch managementPhishingPhishing simulationPretextingPrivilege escalationRansomwareSandboxingSecurity awareness trainingSecurity operations centreShadow ITSIEMSOARSocial engineeringSpear phishingSupply chain attackThird-party patchingThreat huntingThreat intelligenceVishingVulnerabilityWhalingZero trustZero-day
Identity and access
Accounts, authentication, and who can reach what. The most attacked layer in most businesses.
Identity and access management →
Access reviewActive DirectoryBreak-glass accountConditional accessConsent phishingDevice complianceDomain controllerEntra ID P2FIDO2Guest accountIdentity and access managementIdentity ProtectionJoiner, mover, leaverJust-in-time accessKerberoastingKerberosLDAPLegacy authenticationMFA fatigueMicrosoft Entra IDMulti-factor authenticationOAuthOffboardingOpenID ConnectPasskeyPassword managerPassword policyPasswordless authenticationPhishing-resistant MFAPrivileged access managementPrivileged Identity ManagementRole-based access controlSAMLSCIMService accountSingle sign-onTenantTiered administrationToken theft
Microsoft 365 and cloud
The platform most businesses run on, and the licensing and security decisions inside it.
300-seat capBYODCloud migrationCloud Solution ProviderData loss preventioneDiscoveryExchange OnlineInfrastructure as a serviceInsider Risk ManagementLitigation holdMicrosoft 365Microsoft 365 Business PremiumMicrosoft 365 CopilotMicrosoft 365 E3Microsoft 365 E5Microsoft AzureMicrosoft Defender for Cloud AppsMicrosoft Defender for EndpointMicrosoft Defender for IdentityMicrosoft Defender for Office 365Microsoft Defender SuiteMicrosoft IntuneMicrosoft PurviewMicrosoft Purview SuiteMicrosoft Secure ScoreMicrosoft TeamsMobile device managementOneDrive for BusinessOversharingPlatform as a serviceRetention policySensitivity labelShared responsibility modelSharePoint OnlineSoftware as a serviceTeams PhoneTenant-to-tenant migrationWindows Autopilot
Networks and infrastructure
Firewalls, switches, wireless, and the plumbing everything else depends on.
802.1XBandwidthDeep packet inspectionDHCPDKIMDMARCDMZDNSFirewallGuest networkIntrusion prevention systemIPsecLatencyNATNetwork monitoringNetwork segmentationNetwork switchNext-generation firewallPacket lossPatch TuesdayPort forwardingPower over EthernetProfessional services automationQuality of serviceRADIUSRemote monitoring and managementSD-WANService level agreementSNMPSPFSSIDSSL VPNSubnetSyslogTLS certificateUnified threat managementUptimeVLANVPNWireless access pointWireless site surveyWPA3
Compliance and frameworks
HIPAA, PCI, SOC 2, NIST, CMMC, and the evidence work behind them.
Acceptable use policyAttestationAudit evidenceAudit logBreach notificationBusiness associate agreementBusiness continuity planCardholder dataCMMCCompensating controlControlled unclassified informationCyber insuranceData classificationGap assessmentGDPRHIPAAIncident response planISO 27001NIST Cybersecurity FrameworkNIST SP 800-171PCI DSSPenetration testing requirementPersonally identifiable informationPlan of action and milestonesProtected health informationRetention scheduleRisk assessmentSecurity controlSecurity policySOC 2SOC 2 Type 2SPRS scoreTabletop exerciseTrust Services CriteriaVendor risk management
Backup and disaster recovery
Getting the business back after hardware fails, someone deletes the wrong thing, or you are encrypted.
Backup and disaster recovery →
3-2-1 ruleAir-gapped backupBackupBackup windowBare metal restoreBusiness impact analysisCloud backupDeduplicationDisaster recoveryDR siteFailbackFailoverFull backupImmutable backupIncremental backupMean time to recoveryOffsite backupRecovery point objectiveRecovery time objectiveReplicationRestore testSaaS backupSnapshotVersioningVolume Shadow CopyWarm site
Penetration testing
Offensive security: how testing is scoped, what the findings mean, and how vulnerabilities are rated.
Blue teamBuffer overflowCross-site request forgeryCross-site scriptingCVECVSSCWEDefault credentialsEnumerationExploitationExposed serviceExternal penetration testFalse positiveInsecure direct object referenceInternal penetration testMisconfigurationOWASP Top 10Penetration testPivotingPost-exploitationProof of conceptPurple teamReconnaissanceRed teamRemediationRemote code executionRetestRisk ratingRules of engagementScopeServer-side request forgeryShodanSocial engineering assessmentSQL injectionVulnerability scanWeb application penetration test
Something missing?
This is a working glossary and it grows. If a term you ran into is not here, or a definition could be clearer, tell us and we will add or fix it. If a vendor used a word at you and you would like a straight answer about what it actually means for your business, ask an engineer.
Talk to someone who explains it properly
We work with businesses that want to understand what they are buying and why. Book a call and get straight answers about your environment, with no obligation.
Call (855) 737-9500 / (480) 573-3349
Email [email protected]
15-minute response on critical issues, 24/7. Onboarding in two to three weeks.