Cybersecurity Glossary
This is a general reference for the terminology used across the site, covering cybersecurity, networking, Linux, security operations, application security, AI and automotive security.
The definitions are intentionally practical rather than academic. Each term explains what it means and why it matters when assessing a system.
Cybersecurity fundamentals
Asset
An asset is anything valuable that needs protection. It could be data, a device, a user account, a service, a cryptographic key or a vehicle function.
Security view: Start threat modelling by identifying what could be harmed, stolen, changed or made unavailable.
Attack surface
The attack surface is the collection of places where an attacker might interact with a system. This includes network ports, web forms, APIs, wireless interfaces, software dependencies and physical access points.
Security view: Reducing unnecessary exposure usually reduces the number of opportunities an attacker has.
Vulnerability
A vulnerability is a weakness that could be exploited to violate security or safety expectations.
Security view: A vulnerability is not automatically a full compromise. Its real risk depends on exploitability, affected assets, required access and impact.
CVE
A CVE, or Common Vulnerabilities and Exposures entry, is a public identifier for a specific security vulnerability. It normally has a format such as CVE-2025-4598.
Security view: A CVE gives defenders and tools a shared name for a weakness, but the identifier alone does not tell you whether a particular system is exploitable.
Exploit
An exploit is a technique, payload or sequence of actions that takes advantage of a vulnerability.
Security view: A proof of concept demonstrates that a weakness can be triggered; a practical exploit also considers reliability, access and consequences.
Threat model
A threat model is a structured description of what a system does, what needs protecting, who might attack it and how an attack could happen.
Security view: A threat model is a way to make security assumptions visible before they become incidents.
Trust boundary
A trust boundary is a point where data, identity or authority moves between components with different levels of trust.
Security view: Examples include a user-to-API request, a public network-to-server connection or an uploaded document entering an internal knowledge base.
Reverse shell
A reverse shell is a command shell initiated by a compromised system back to an operator-controlled listener.
Security view: Outbound connections can bypass assumptions about inbound filtering and NAT, so monitor unexpected egress and shell-like processes.
STRIDE
STRIDE is a threat-modelling framework that groups security concerns into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege.
Security view: STRIDE is a useful lens for finding impacts and trust-boundary problems. It should be combined with system-specific attack techniques where needed.
Networking and wireless security
IP address
An IP address identifies a network interface so that traffic can be sent to and from it. IPv4 addresses look like 192.168.1.10; IPv6 addresses use a longer hexadecimal format.
Security view: An IP address identifies a network location, not necessarily a person or a trusted device.
MAC address
A MAC address is a link-layer identifier associated with a network interface. It is used for communication on the local network.
Security view: MAC addresses can be changed or spoofed, so they are not strong proof of identity.
Port
A port is a numbered endpoint used by network services. For example, a web server may listen on TCP port 443 for HTTPS traffic.
Security view: Open ports expose services that need to be identified, patched, configured and monitored.
Protocol
A protocol is an agreed set of rules for how systems communicate. HTTP, DNS, TCP, SSH and CAN are examples.
Security view: Protocol testing looks for weaknesses in how messages are structured, validated, authenticated and handled.
Packet
A packet is a unit of data transmitted across a network. It normally contains control information, such as source and destination addresses, plus a portion of the message being transported.
Security view: Packet captures can reveal communication patterns, credentials, misconfigurations and unexpected data flows.
Wi-Fi security
Wi-Fi security covers the controls protecting wireless networks, including authentication, encryption, access-point configuration and client behaviour.
Security view: A wireless network is an exposed radio interface. An attacker may interact with it without needing physical access to a network socket.
Monitor mode
Monitor mode is a wireless-interface mode that allows a device to observe nearby Wi-Fi frames rather than only traffic addressed to itself.
Security view: It is useful for authorised wireless assessment and packet analysis, but observing traffic does not automatically decrypt protected communications.
OSI model
The OSI model is a seven-layer way to reason about network communication, from physical signals through to application protocols.
Security view: It helps place a failure or attack at the right layer, such as ARP spoofing at the data-link layer or an HTTP flaw at the application layer.
ARP
ARP, or Address Resolution Protocol, maps an IPv4 address to a hardware address on a local network.
Security view: ARP has weak authentication by design, which is why local attackers can attempt ARP spoofing or poisoning.
NAT
NAT, or Network Address Translation, rewrites network addresses so multiple private hosts can share or access external networks through another address.
Security view: NAT is not a firewall, but it changes reachability and can affect reverse shells, logging and attack paths.
DHCP
DHCP, or Dynamic Host Configuration Protocol, automatically provides devices with network settings such as an IP address, gateway and DNS server.
Security view: Rogue or misconfigured DHCP can redirect traffic or create confusing network behaviour.
DNS
DNS, or Domain Name System, translates names such as example.com into network addresses and other records.
Security view: DNS is a trust and visibility boundary. Manipulation, tunnelling and lookups to suspicious domains can all matter during an assessment.
Routing
Routing is the process of selecting where network traffic should go next.
Security view: Incorrect routes can break connectivity, expose management paths or send sensitive traffic through an unintended device.
TLS
TLS, or Transport Layer Security, encrypts and authenticates many network connections, including HTTPS.
Security view: Certificate validation, protocol versions, trust stores and key handling all affect whether TLS provides meaningful protection.
Linux and security operations
Linux permissions
Linux permissions control which users and groups can read, write or execute files and use certain system resources.
Security view: Incorrect ownership, excessive permissions and unsafe service accounts can turn a small foothold into privilege escalation.
Container
A container packages an application and its dependencies while sharing the host operating system kernel.
Security view: Containers improve isolation and repeatability, but they are not automatically security boundaries. Review images, privileges, mounts, secrets and exposed ports.
Docker
Docker is a platform and toolset commonly used to build, run and manage containers.
Security view: Treat Docker configuration as part of the attack surface. Access to the Docker socket can often provide authority close to host-level control.
Root
Root is the Linux superuser account. It has broad authority over the operating system and is not restricted like a normal user.
Security view: Root access should be tightly controlled because a compromise at this level can affect almost every local security control.
Privilege escalation
Privilege escalation is gaining more authority than an account or process was intended to have. It may be vertical, such as a user becoming root, or horizontal, such as one user accessing another user’s data.
Security view: Look for weak permissions, exposed credentials, vulnerable services, insecure configurations and broken authorisation checks.
Log
A log is a record of an event, such as a login, process start, network connection or configuration change.
Security view: Logs support detection, investigation and accountability, but only if they are complete, correctly timestamped and protected from unauthorised modification.
SIEM
A SIEM, or security information and event management platform, collects and analyses logs from multiple systems to identify suspicious activity.
Security view: A SIEM can improve visibility, but it cannot compensate for missing telemetry, poor time synchronisation or badly tuned detection rules.
IOC
An IOC, or indicator of compromise, is an observable sign associated with malicious activity. Examples include a file hash, domain, IP address, registry change or unusual process.
Security view: IOCs are useful clues, but they can become outdated or be changed by attackers. Behaviour and context matter too.
Application and API security
API
An API, or application programming interface, is a defined way for software components to request data or actions from one another.
Security view: Treat an API like any other exposed application boundary. Check authentication, authorisation, input validation, rate limiting, error handling and logging.
JSON
JSON, or JavaScript Object Notation, is a text format commonly used to exchange structured data between applications.
Security view: Parse it safely, validate its structure and do not assume that fields supplied by a client are trustworthy.
Rate limiting
Rate limiting restricts how many requests a user, client or source can make during a period of time.
Security view: It helps reduce abuse, brute force and resource exhaustion, but it should support—not replace—authentication and authorisation.
Authentication
Authentication is the process of verifying who or what is making a request.
Security view: Authentication answers “who are you?” It does not answer whether that identity is allowed to perform a particular action.
Authorisation
Authorisation determines what an authenticated identity is allowed to access or do.
Security view: Authorisation must be enforced by the service that owns the resource or action, not assumed because a request came from a trusted-looking client.
Input validation
Input validation checks that data received by an application is present, correctly formatted and within expected limits.
Security view: Validation reduces parser confusion and injection risk, but it should be paired with safe output handling and least privilege.
Injection
An injection vulnerability occurs when attacker-controlled data is interpreted as commands, queries or instructions rather than treated as ordinary data.
Security view: SQL injection, command injection and prompt injection differ in their target, but they share the dangerous boundary between data and instructions.
Automotive security
ECU
An ECU, or electronic control unit, is a computer embedded in a vehicle. It may control or monitor functions such as the engine, brakes, body systems or infotainment.
Security view: An ECU is an embedded system with its own software, interfaces, credentials and trust relationships. Compromising one ECU may provide a path to other vehicle functions.
CAN bus
The Controller Area Network (CAN) bus is a vehicle communication network that allows ECUs to exchange short messages without needing a central network switch.
Security view: Traditional CAN does not inherently provide strong authentication for each message. Assess message validation, network segmentation, gateway controls and the safety impact of injected traffic.
UDS
Unified Diagnostic Services (UDS) is a protocol used to diagnose and configure vehicle ECUs. It can support functions such as reading fault codes, running tests and updating software.
Security view: Diagnostic services require careful access control because legitimate maintenance functions can become dangerous when exposed to an unauthorised tester.
Fuzzing
Fuzzing is the automated testing of software with unexpected, malformed or unusual inputs to find crashes and other weaknesses.
Security view: Good fuzzing defines a safe test boundary, monitors for failures and turns reproducible results into actionable vulnerability evidence.
Attack surface analysis
In automotive security, attack surface analysis identifies the interfaces through which a vehicle or ECU can be influenced. These may include diagnostic ports, Bluetooth, Wi-Fi, cellular connectivity, USB, mobile applications and backend services.
Security view: The vehicle should be assessed as a connected system rather than as an isolated device. A weakness in a non-safety-critical component may still create a route toward a higher-impact function.
Hardware-in-the-loop
Hardware-in-the-loop (HIL) testing connects real or simulated hardware to a test environment so that a system can be exercised without using the complete production setup.
Security view: HIL can provide a safer, repeatable boundary for testing embedded behaviour, but the interfaces and simulation assumptions still need to be threat-modelled.
SocketCAN
SocketCAN is the Linux networking framework that exposes CAN interfaces through normal socket-based tools and programs.
Security view: It makes automotive network testing accessible in software, but a virtual interface is not automatically representative of every physical vehicle control or safety constraint.
AI and machine learning
You do not need to become a machine-learning engineer to assess an AI system. If you understand trust boundaries, data integrity, authentication, authorisation and attack paths, you already have most of the right instincts.
The AI terms below are explained in that same security context.
AI model
An AI model is software that turns an input into an output. In an assistant, the input may be a user’s question and the output may be a written answer.
Cybersecurity view: Treat the model as an application component—not as an identity provider, authorisation engine or source-of-truth validator.
Machine learning
Machine learning is a way of building software that learns patterns from examples instead of relying only on rules written by a programmer.
Cybersecurity view: The training data, features, model file and evaluation process become security-relevant assets that can be manipulated or misinterpreted.
Dataset
A dataset is a collection of examples used to analyse a problem or train and evaluate a machine-learning model.
Cybersecurity view: Check its provenance, permissions, quality, privacy and separation between training and test data.
Feature
A feature is an individual measurable property supplied to a machine-learning model, such as password length or whether a character is uppercase.
Cybersecurity view: Features are inputs, so unexpected values, leakage and attacker-controlled manipulation can affect the model’s decision.
Classification
Classification is a machine-learning task that assigns an input to a category, such as strong or weak, benign or malicious.
Cybersecurity view: Classification output is a decision aid, not proof. Check false positives, false negatives, confidence and the impact of automated actions.
Prompt
A prompt is the input sent to the model. It may contain the user’s message, system rules, conversation history and data retrieved from other systems.
Cybersecurity view: Treat it as an assembled request at an application boundary. Anything inserted into it can influence the model’s output.
Context
Context is additional information supplied to the model for one answer. For example, an assistant may receive a question plus the contents of two internal documents.
Cybersecurity view: Context is like data attached to a ticket or passed between services. It needs provenance and a trust assessment before another component relies on it.
RAG
Retrieval-augmented generation, or RAG, is a design where an assistant searches an external knowledge source before generating an answer.
|
|
Cybersecurity view: RAG is a data-flow pattern. Model the document store, ingestion pipeline, search service and access controls separately. A single “AI” box hides important trust boundaries.
Retrieval
Retrieval is the search step that selects information to provide to the model. It may use keywords, meaning-based similarity or both.
Cybersecurity view: Retrieval is an input-selection and authorisation problem. Ask who can influence the results and whether “relevant” is being confused with “trusted.”
Embedding
An embedding is a numerical representation of the approximate meaning of a piece of text. Search systems use embeddings to find passages that are conceptually related to a question.
Cybersecurity view: An embedding is derived data. It inherits risks from the source text and can affect search behaviour and ranking. It is not a security label or proof that the source is safe.
Vector database
A vector database stores embeddings and helps the application search them efficiently. It may also store the original text, document identifiers, permissions and metadata.
Cybersecurity view: Assess it like any other data store: access control, tenant separation, tamper resistance, deletion, retention and backups.
Prompt injection
Prompt injection happens when untrusted text contains instructions designed to influence the model. The text may come from a user, web page, uploaded document or retrieved internal record.
Cybersecurity view: This resembles untrusted input crossing into an interpreter. Ask whether the application clearly separates data from commands.
Indirect prompt injection
An indirect prompt injection is delivered through content the model reads rather than through the user’s direct message.
In a RAG system, an attacker may poison a document and wait for a legitimate employee to ask a question that retrieves it.
Cybersecurity view: This is a stored-input or supply-chain attack path. The attacker does not need to control the victim’s session if they can influence a trusted data source.
Data poisoning
Data poisoning means inserting false, malicious or misleading information into data that a system later relies on.
Cybersecurity view: The initial issue is usually data-integrity failure, or Tampering in STRIDE terms. The consequences may later include Information Disclosure, Spoofing or Elevation of Privilege.
Grounding
Grounding means giving the model external information to make an answer more relevant to a source or situation. RAG is one way to ground an answer.
Cybersecurity view: Grounding is not validation. An answer can be grounded in a poisoned document and still be confidently wrong.
Hallucination
An AI hallucination is an answer that sounds plausible but is unsupported, incorrect or invented.
Cybersecurity view: Do not label every bad answer a hallucination. That can hide a more actionable root cause, such as poisoned data, broken access control or missing provenance.
Tool calling
Tool calling allows the model to request an external function, API or service. A tool might search a database, create a ticket, send an email or reset a credential.
Cybersecurity view: Treat every tool as an API with an attacker-influenced caller. Enforce authorisation in the tool or service itself, not only in the model.
Agent
An AI agent is an application that uses a model to plan or perform multiple steps, often with access to tools and memory.
Cybersecurity view: An agent is an orchestration layer combining identity, state, tools and model-generated decisions. Threat-model the whole workflow.
Guardrail
A guardrail is a rule, filter or control intended to limit unsafe inputs, outputs or actions. Examples include blocking sensitive data, rejecting tool calls or requiring confirmation.
Cybersecurity view: A guardrail is a security control, not a guarantee. Identify where it runs, what it can see and what happens when it fails.
Provenance
Provenance is the history of where information came from, who changed it and which version was used.
For an AI answer, useful provenance may include source documents, document versions, approval status and retrieval time.
Cybersecurity view: Provenance supports integrity, investigation and non-repudiation. Without it, users may not distinguish approved guidance from attacker-controlled content.
The short version
|
|
The model is only one component in that chain. The threat-modelling questions remain familiar:
- Who can change the data?
- Who can retrieve it?
- Which identity does the assistant use?
- Can untrusted text become an instruction?
- What can the assistant read or change?
- Can we prove what influenced the decision?