Security+

Vulnerability

A weakness or flaw in system architecture, design, or implementation that can be exploited by an attacker.

Threat

A potential cause of an unwanted incident that may result in harm, damage, or exploitation to a system or organization.

Risk

The potential impact and likelihood of an adverse event occurring when an exploitation route is leveraged against a weakness.

Advanced Persistent Threat (APT)

A sustained, highly sophisticated network intrusion often carried out by well-resourced groups commonly associated with state-sponsored espionage.

Zero-Day Threat

An exploit targeting a previously undisclosed software flaw before the vendor or developer has released a patch or mitigation.

Attack Surface

The total sum of all points and interfaces where an unauthorized user or threat actor can attempt to enter or extract data.

Attack Vector

The specific path, method, or pathway used by an adversary to gain unauthorized access to a computer or network.

Digital Certificate

An electronic credential that authenticates an entity and cryptographically binds its identity to a public key.

Public Key Infrastructure (PKI)

A comprehensive framework of certificate authorities, policies, hardware, and software used to issue, manage, and revoke digital credentials.

Certificate Signing Request (CSR)

A block of encoded text sent to a certificate authority containing an applicant's public key and identifying information required to issue a certificate.

Diffie–Hellman (DH) Key Exchange

A cryptographic method enabling two parties to securely calculate a shared session key over an untrusted channel without transmitting the secret itself.

Perfect Forward Secrecy (PFS)

A cryptographic property ensuring that individual session keys remain protected and past traffic cannot be decrypted even if a long-term private key is later compromised.

Transport Layer Security (TLS)

A cryptographic protocol operating above the transport layer that encrypts communications, verifies endpoint identity, and prevents downgrade attacks.

Discretionary Access Control (DAC)

An access-control model where individual resource owners determine who is permitted access to their files, typically managed via access control lists.

Mandatory Access Control (MAC)

A non-discretionary access-control framework where access permissions are strictly regulated by a central authority based on fixed security classifications and labels.

Role-Based Access Control (RBAC)

An authorization model where permissions are granted to users based on their assigned organizational job functions and responsibilities.

Attribute-Based Access Control (ABAC)

A dynamic authorization model that evaluates contextual factors, user characteristics, and resource properties to determine access.

Privileged Access Management (PAM)

A set of policies, security practices, and tools dedicated to securing, controlling, and auditing administrative accounts and credentials.

SAML (Security Assertion Markup Language)

An XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider.

OAuth

An open authorization framework enabling third-party applications to obtain limited access to protected user resources using access tokens rather than user credentials.

IEEE 802.1X

A standard providing port-based network access control that authenticates devices before granting them full connectivity to a local area network.

Air-Gapped System

A computer or network architecture physically disconnected from all external networks and the public internet to secure sensitive data or processes.

Intrusion Detection System (IDS)

A passive security system or software tool that monitors network traffic or system events for suspicious patterns and generates alerts without intervening.

Intrusion Prevention System (IPS)

An active inline network security device that inspects traffic, identifies malicious activities, and automatically terminates connections or blocks traffic.

Unified Threat Management (UTM)

An appliance that consolidates multiple security functions—such as firewalling, intrusion prevention, antivirus, and content filtering—into a single device, creating a single point of failure.

IPsec Transport Mode

An operational mode that encrypts only the payload of IP packets while leaving the original IP headers intact, typically deployed for end-to-end host communication.

IPsec Tunnel Mode

An operational mode that encrypts the entire original IP packet and encapsulates it inside a new IP header, commonly used in site-to-site VPNs.

Internet Key Exchange (IKE)

A protocol suite used to authenticate peers, negotiate ciphers, and establish security associations for IPsec connections.

Zero Trust Architecture (ZTA)

A security philosophy requiring continuous verification and strict least-privilege enforcement for every request, regardless of whether it originates inside or outside the network perimeter.

Race Condition

A software flaw occurring when system behavior depends on the uncontrollable order or timing of concurrently executing processes or threads.

Time-of-Check to Time-of-Use (TOCTOU)

A concurrency bug where a resource's state or authorization changes during the interval between its verification and the execution of an action.

Buffer Overflow

A memory corruption anomaly where incoming data exceeds allocated storage limits, overwriting adjacent memory spaces and potentially executing arbitrary code.

Cross-Site Scripting (XSS)

A web vulnerability where an attacker injects malicious client-side scripts into web applications, which execute in the browsers of unsuspecting users.

Password Spraying

An authentication attack that attempts a small set of commonly used passwords across a broad range of user accounts to circumvent lockout mechanisms.

Replay Attack

A network attack in which legitimate authentication packets or session tokens are intercepted and retransmitted to gain unauthorized access.

Directory Traversal

An attack that manipulates file paths using characters such as ../ to access restricted files located outside the designated web root folder.

Static Code Analysis

A software testing practice that inspects source code, bytecode, or binaries for security bugs and vulnerabilities without running the application.

Data Loss Prevention (DLP)

A set of technologies and strategies designed to detect, track, and prevent sensitive or classified information from unauthorized exfiltration.

Sender Policy Framework (SPF)

A DNS-based email validation method enabling domain owners to publish a list of IP addresses authorized to send emails on behalf of their domain.

DomainKeys Identified Mail (DKIM)

An email authentication protocol that appends a verifiable cryptographic signature to outgoing message headers, allowing recipients to verify sender integrity.

DMARC

An email authentication policy framework that leverages SPF and DKIM verification results to determine whether to accept, quarantine, or reject failing messages.

Data Controller

The legal entity or organization that establishes the legal basis, purposes, and methods for processing personal data.

Data Processor

A third-party entity authorized to collect, store, or process personal data strictly under the guidance and instructions of an overseeing authority.

Passive Reconnaissance

An intelligence-gathering phase where an analyst or attacker collects information about a target using public sources or traffic analysis without direct system contact.

Active Reconnaissance

An assessment phase where an analyst or attacker sends direct probes, port scans, or queries to target systems to discover running services and vulnerabilities.

Vulnerability

A weakness or flaw in system architecture, design, or implementation that can be exploited by an attacker.

Threat

A potential cause of an unwanted incident that may result in harm, damage, or exploitation to a system or organization.

Risk

The potential impact and likelihood of an adverse event occurring when an exploitation route is leveraged against a weakness.

Advanced Persistent Threat (APT)

A sustained, highly sophisticated network intrusion often carried out by well-resourced groups commonly associated with state-sponsored espionage.

Zero-Day Threat

An exploit targeting a previously undisclosed software flaw before the vendor or developer has released a patch or mitigation.

Attack Surface

The total sum of all points and interfaces where an unauthorized user or threat actor can attempt to enter or extract data.

Attack Vector

The specific path, method, or pathway used by an adversary to gain unauthorized access to a computer or network.

Digital Certificate

An electronic credential that authenticates an entity and cryptographically binds its identity to a public key.

Public Key Infrastructure (PKI)

A comprehensive framework of certificate authorities, policies, hardware, and software used to issue, manage, and revoke digital credentials.

Certificate Signing Request (CSR)

A block of encoded text sent to a certificate authority containing an applicant's public key and identifying information required to issue a certificate.

Diffie–Hellman (DH) Key Exchange

A cryptographic method enabling two parties to securely calculate a shared session key over an untrusted channel without transmitting the secret itself.

Perfect Forward Secrecy (PFS)

A cryptographic property ensuring that individual session keys remain protected and past traffic cannot be decrypted even if a long-term private key is later compromised.

Transport Layer Security (TLS)

A cryptographic protocol operating above the transport layer that encrypts communications, verifies endpoint identity via certificates, and prevents downgrade attacks.

Discretionary Access Control (DAC)

An access-control model where individual resource owners determine who is permitted access to their files, typically managed via access control lists.

Mandatory Access Control (MAC)

A non-discretionary access-control framework where access permissions are strictly regulated by a central authority based on fixed security classifications and labels.

Role-Based Access Control (RBAC)

An authorization model where permissions are granted to users based on their assigned organizational job functions and responsibilities.

Attribute-Based Access Control (ABAC)

A dynamic authorization model that evaluates contextual factors, user characteristics, and resource properties to determine access.

Privileged Access Management (PAM)

A set of policies, security practices, and tools dedicated to securing, controlling, and auditing administrative accounts and credentials.

SAML (Security Assertion Markup Language)

An XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider.

OAuth

An open authorization framework enabling third-party applications to obtain limited access to protected user resources using access tokens rather than user credentials.

IEEE 802.1X

A standard providing port-based network access control that authenticates devices before granting them full connectivity to a local area network.

Air-Gapped System

A computer or network architecture physically disconnected from all external networks and the public internet to secure sensitive data or processes.

Intrusion Detection System (IDS)

A passive security system or software tool that monitors network traffic or system events for suspicious patterns and generates alerts without intervening.

Intrusion Prevention System (IPS)

An active inline network security device that inspects traffic, identifies malicious activities, and automatically terminates connections or blocks traffic.

Unified Threat Management (UTM)

An appliance that consolidates multiple security functions—such as firewalling, intrusion prevention, antivirus, and content filtering—into a single device, creating a single point of failure.

IPsec Transport Mode

An operational mode that encrypts only the payload of IP packets while leaving the original IP headers intact, typically deployed for end-to-end host communication.

IPsec Tunnel Mode

An operational mode that encrypts the entire original IP packet and encapsulates it inside a new IP header, commonly used in site-to-site VPNs.

Internet Key Exchange (IKE)

A protocol suite used to authenticate peers, negotiate ciphers, and establish security associations for IPsec connections.

Zero Trust Architecture (ZTA)

A security philosophy requiring continuous verification and strict least-privilege enforcement for every request, regardless of whether it originates inside or outside the network perimeter.

Race Condition

A software flaw occurring when system behavior depends on the uncontrollable order or timing of concurrently executing processes or threads.

Time-of-Check to Time-of-Use (TOCTOU)

A concurrency bug where a resource's state or authorization changes during the interval between its verification and the execution of an action.

Buffer Overflow

A memory corruption anomaly where incoming data exceeds allocated storage limits, overwriting adjacent memory spaces and potentially executing arbitrary code.

Cross-Site Scripting (XSS)

A web vulnerability where an attacker injects malicious client-side scripts into web applications, which execute in the browsers of unsuspecting users.

Password Spraying

An authentication attack that attempts a small set of commonly used passwords across a broad range of user accounts to circumvent lockout mechanisms.

Replay Attack

A network attack in which legitimate authentication packets or session tokens are intercepted and retransmitted to gain unauthorized access.

Directory Traversal

An attack that manipulates file paths using characters such as ../ to access restricted files located outside the designated web root folder.

Static Code Analysis

A software testing practice that inspects source code, bytecode, or binaries for security bugs and vulnerabilities without running the application.

Data Loss Prevention (DLP)

A set of technologies and strategies designed to monitor data activity, restrict unauthorized authorization, and prevent sensitive information from being exfiltrated in use, transit, or rest.

Sender Policy Framework (SPF)

A DNS-based email validation method enabling domain owners to publish a list of IP addresses authorized to send emails on behalf of their domain.

DomainKeys Identified Mail (DKIM)

An email authentication protocol that appends a verifiable cryptographic signature to outgoing message headers, allowing recipients to verify sender integrity.

DMARC

An email authentication policy framework that leverages SPF and DKIM verification results to determine whether to accept, quarantine, or reject failing messages.

Data Controller

The legal entity or organization that establishes the legal basis, purposes, and methods for processing personal data.

Data Processor

A third-party entity authorized to collect, store, or process personal data strictly under the guidance and instructions of an overseeing authority.

Passive Reconnaissance

An intelligence-gathering phase where an analyst or attacker collects information about a target using public sources or traffic analysis without direct system contact.

Active Reconnaissance

An assessment phase where an analyst or attacker sends direct probes, port scans, or queries to target systems to discover running services and vulnerabilities.

NetFlow Analyzer

A network monitoring application that collects and inspects flow metadata to track bandwidth consumption, traffic volume, and network performance anomalies.

Security Architectural Considerations

Core structural requirements including availability, integrity, confidentiality, resilience, scalability, and maintainability that guide defensive infrastructure design.

Security Guardrail

An automated policy or programmatic safeguard enforced in cloud architectures to constrain configurations within acceptable compliance parameters.

Continuity of Operations Plan (COOP)

A formal organizational roadmap establishing procedures to sustain mission-essential operations and critical infrastructure throughout an emergency.

Workforce Multiplier

The implementation of automated workflows and security orchestration (SOAR) that expands the throughput and effectiveness of analysts without increasing headcount.

Virtual Machine Escape (VME)

An exploit wherein an adversary bypasses virtualization boundaries in a guest instance to interact directly with and compromise the host hypervisor or operating system.

Single Loss Expectancy (SLE)

The financial loss anticipated from a single realized risk event, determined by the formula $\text{SLE} = \text{Asset Value} \times \text{Exposure Factor}$.

Antivirus (AV)

Host-based security software that inspects files and processes to detect, quarantine, and eliminate known malicious software via signatures and heuristics.

Vulnerability vs. Threat vs. Risk

A system weakness is the vulnerability, an external agent capable of exploiting it is the threat, and the calculated probability combined with resulting business impact is the risk.

Asymmetric Cryptography Key Roles

A dual-key system where a widely distributed public key handles encryption and signature verification, while a confidential private key handles decryption and digital signatures.