Compare Tools

202 terms

Security glossary

The words of security in plain English, from ACME to zero trust. Terms marked in our guides link here.

#ABCDEFGHIJKLMNOPQRSTVWXZ

.htaccess
A per-directory configuration file that Apache, and LiteSpeed in part, read while handling requests. Web servers compared
2FA
Two-factor authentication: a login that needs a second proof besides the password, such as a code or a security key.
3-2-1-1-0 rule
Three copies, two storage types, one off site, one offline or immutable, and zero errors in restore tests. Ransomware-proof backups
ACME
The protocol certificate authorities such as Let’s Encrypt use to issue and renew TLS certificates automatically.
Activation Lock
A Find My feature that stops anyone from erasing and reusing a Mac without the owner's Apple Account password. macOS security settings worth checking
Advanced Data Protection
An optional Apple setting that extends end-to-end encryption to iCloud Backup and other iCloud data. Secure messengers compared
Advanced Protection
An Android 16 setting that turns on a fixed set of hardening measures with one switch. iOS and Android security compared
Agent
An AI system that can call tools or take actions, not only produce text. Prompt injection
AI literacy
The skills and understanding needed to use AI systems knowingly and to recognise their risks and limits. A one page AI usage policy for small teams
Algorithm confusion
An attack in which a verifier is tricked into checking a token with a different algorithm than intended. JWT security
Allowlist
A list of approved items; everything not on it is blocked. Browser extension audit
AppArmor
A path-based mandatory access control system, enabled by default on Debian and Ubuntu. Linux server distributions compared
Argon2id
A memory-hard password hashing algorithm that OWASP recommends as the first choice. Strong passwords and passphrases
Attack surface
Everything an attacker could try to reach: open ports, login pages, plugins, APIs and the people who use them.
Audit log
A record of who did what and when, which administrators can review or export. Where your prompts go
Backdoor
A hidden way into a system that bypasses normal authentication.
Background Security Improvements
Apple's mechanism for shipping urgent security fixes between regular macOS updates. macOS security settings worth checking
Backport
A security fix applied to the older package version a release ships, instead of moving to a new upstream version. Linux server distributions compared
base64url
A variant of base64 encoding that uses only characters safe in URLs; it hides nothing. JWT security
Browser extension
An add-on that runs inside the browser and can read or change web pages, depending on its permissions. Browser extension audit
Browser profile
A separate set of history, logins and extensions within the same browser. Browser extension audit
Brute force
Guessing passwords or keys by trying very many combinations.
Business email compromise
Fraud in which a real or imitated business mailbox is used to request payments or data. Phishing signals when the grammar is perfect
CAA
Certification Authority Authorization: a DNS record that lists the certificate authorities allowed to issue certificates for a domain. Website launch checklist
Callback phishing
A scam email that asks you to phone a number, where a caller then talks you into harmful actions. Phishing signals when the grammar is perfect
Checksum
A short value computed from data. If one bit of the data changes, the checksum changes, which makes tampering visible.
ChromeOS Flex
A version of ChromeOS that installs on certified older PCs and Macs. Life after end of support
Claim
A statement inside a token, such as the user ID in sub or the expiry time in exp. JWT security
Clickjacking
An attack that hides your page in a frame under a decoy, so the visitor clicks on your page without knowing it. Security headers explained
CMS
A content management system: software that lets editors change a website through a web interface instead of editing code. CMS security compared
CNAME
A DNS record that makes one name an alias of another, often used to point a subdomain at a hosting service. Static site security
Composer
The standard dependency manager for PHP, used to install and update Drupal and TYPO3 along with their extensions. CMS security compared
Content delivery network
A network of servers in many locations that cache and deliver your files close to visitors. Shared hosting, VPS or managed
Content Security Policy
A response header that restricts which scripts and other resources a page may load and run. SQL injection and XSS
Controlled folder access
Defender's ransomware protection that lets only trusted apps change files in protected folders. Windows 11 hardening
Credential stuffing
Trying username and password pairs leaked from one service on many other services.
CRL
Certificate Revocation List: a signed list of revoked certificates published by a certificate authority. HTTPS done properly
CSP
Content Security Policy: a header that lists which sources a page may load scripts, styles, images and frames from. Security headers explained
CVE
Common Vulnerabilities and Exposures: the public catalogue that gives each known vulnerability an identifier such as CVE-2024-3094.
CVSS
Common Vulnerability Scoring System: rates the severity of a vulnerability from 0 to 10 (none, low, medium, high, critical).
Data processing agreement
The contract required by Article 28 of the GDPR when a provider processes personal data on your behalf. Where your prompts go
Data residency
The country or region where data is stored and processed. Where your prompts go
Deepfake
AI-generated or manipulated image, audio or video that resembles real people, places or events and could pass as authentic. A one page AI usage policy for small teams
Defence in depth
Several independent layers of protection, so that one failure does not open the whole system.
Dependency confusion
An attack in which a public package with the same name as an internal one is installed in its place. Software supply chain security
Deploy key
A credential that lets a build service or person publish to the hosting or push to a repository. Static site security
Deployer
Under the EU AI Act, an organisation that uses an AI system under its own authority, as opposed to the provider that develops it. A one page AI usage policy for small teams
DKIM
DomainKeys Identified Mail: a signature on outgoing email that receivers verify with a public key published in DNS. Website launch checklist
DMARC
A DNS policy that tells receiving mail servers what to do with mail that fails SPF and DKIM checks for your domain.
DOM-based XSS
Cross-site scripting that happens entirely in client-side JavaScript, without the server returning the payload. SQL injection and XSS
Drop-in file
A small configuration file in a .d directory that is read in addition to the main configuration file. SSH hardening
Dynamic credentials
Credentials created on demand for one consumer and revoked automatically after a short time. Secrets management
Ed25519
A modern public key signature algorithm with short keys and fast, safe implementations. SSH hardening
Emergency access
A feature that lets a trusted person request access to your vault after a waiting period you set. Password managers compared
Encryption at rest
Data encrypted while stored, for example on a disk or in a backup.
End of support
The date after which a vendor stops shipping security fixes for a product. Patch management for small teams
End-to-end encryption
Only the communicating devices hold the keys; the service in between cannot read the content.
Entropy
A measure of how unpredictable a password is, usually given in bits. Strong passwords and passphrases
Event-driven
A design in which a few processes handle many connections by reacting to events, instead of dedicating one process to each client. Web servers compared
Exploit
Code or a technique that takes advantage of a vulnerability.
Extended Security Updates
Microsoft's programme that delivers critical and important security fixes for Windows 10 after its end of support. Life after end of support
Fail open
A failure mode in which an error leads to access being granted instead of denied. OWASP Top 10 explained
fail2ban
A tool that watches logs for repeated failures and blocks the offending addresses in the firewall. SSH hardening
FileVault
macOS full disk encryption that requires your login password before the data on the Mac can be read. macOS security settings worth checking
FIPS-140
A US government standard for validated cryptographic modules, required in some regulated environments. Password hashing compared
Firmware
The software built into hardware such as routers, firewalls and printers. Patch management for small teams
Flood control
A limit on repeated failed actions such as logins, which slows down password guessing. CMS security compared
Forward secrecy
A property of the key exchange that keeps recorded sessions safe even if the server's private key is stolen later. HTTPS done properly
Full-disk encryption
Encryption of an entire drive, so its data cannot be read without the user’s login or a recovery key. Security baseline for small teams
Gatekeeper
The macOS feature that checks an app's signature and notarisation before it opens for the first time. Desktop operating systems compared
GGUF
The model file format used by llama.cpp and tools built on it, holding weights and metadata in one file. Local LLM runners compared
Hash function
A one-way function that turns data of any size into a fixed-size digest. SHA-256 is a common example.
HSTS
HTTP Strict Transport Security: a response header that tells browsers to use only HTTPS for a domain for a set time. HTTPS done properly
HttpOnly
A cookie attribute that prevents JavaScript from reading the cookie. JWT security
Hypervisor
Software that runs several virtual machines on one physical host and keeps them apart. Shared hosting, VPS or managed
IDN homograph
A domain name that uses look-alike characters from another script to imitate a real domain. Phishing signals when the grammar is perfect
Immutable
Describes backup storage that refuses changes or deletion for a set retention period, even by an administrator. Security baseline for small teams
Immutable storage
Storage that refuses changes to or deletion of a backup until its retention period ends. Ransomware-proof backups
Indirect injection
Prompt injection hidden in content the model processes, such as a web page, email or document. Prompt injection
Jump host
A hardened server that admins log in to first, and from which they reach other internal servers. SSH hardening
JWE
JSON Web Encryption: a token format whose content is encrypted, not just signed. JWT security
k-anonymity
A technique where only part of a hash is shared, so the service never learns the full value being checked. Strong passwords and passphrases
KDBX
The encrypted database file format used by KeePass and KeePassXC. Password managers compared
KEV catalogue
CISA’s list of vulnerabilities with evidence of active exploitation. Patch management for small teams
Key derivation
Turning a password into an encryption key with a deliberately slow function such as PBKDF2 or Argon2, so that guessing becomes expensive. Password managers compared
Kill switch
A VPN client feature that blocks all traffic if the encrypted tunnel drops. What a VPN protects, and what it does not
Least privilege
Giving every user, service and key only the rights it needs, and nothing more.
Lockdown Mode
An optional mode on iPhone, iPad and Mac that disables features often abused by targeted spyware. iOS and Android security compared
Lockfile
A file that records the exact versions, and often hashes, of every dependency so installs can be reproduced. AI coding assistants
LTS
Long-term support: a version that receives security fixes for a published, extended period. CMS security compared
LUKS
Linux Unified Key Setup, the standard format for full disk encryption on Linux. Desktop operating systems compared
Malware
Software written to harm, spy on or take control of a device.
Mandatory access control
A security layer that restricts what each program may do, regardless of the user it runs as. Linux server distributions compared
Manifest V3
The current extension platform for Chromium browsers, which replaces code that blocks network requests with declarative rules. Browsers compared for security
Memory-hard
Describes an algorithm that needs a large amount of memory per calculation, which makes parallel cracking expensive. Password hashing compared
Metadata
Data about a message rather than its content, such as sender, recipient, time and IP address. Secure messengers compared
MFA
Multi-factor authentication: a login that combines two or more factors such as knowledge, possession and biometrics.
MFA fatigue
An attack in which repeated push prompts are sent until the user approves one out of annoyance or confusion. Multi-factor authentication compared
Mixed content
Resources loaded over plain HTTP by a page that was itself served over HTTPS. HTTPS done properly
mod_headers
The Apache module that provides the Header directive for adding, changing and removing HTTP headers. Security headers explained
MPM
Multi-Processing Module: the Apache component that decides how connections are handled, for example prefork or event. Web servers compared
Multi-factor authentication
Signing in with two or more different kinds of proof, such as a password plus a passkey or an app on your phone. Security baseline for small teams
musl
A small C standard library that Alpine uses instead of the more common glibc. Linux server distributions compared
Must-use plugin
A PHP file in wp-content/mu-plugins that WordPress loads automatically and that cannot be deactivated from the dashboard. WordPress hardening
NAS
Network attached storage: a small file server for a home or office network. Life after end of support
Nonce
A random value generated for each response that marks specific inline scripts as allowed under a CSP. Security headers explained
Notarisation
Apple's baseline check of apps for malware and misrepresentation, also applied to apps distributed outside the App Store in the EU. iOS and Android security compared
Null MX
An MX record with priority 0 and a single dot as the host name, declaring that a domain accepts no email. Website launch checklist
Number matching
A push approval step in which the user types a number shown on the sign-in screen into the app. Multi-factor authentication compared
OAuth
A standard that lets an app access part of your account through a token you approve, without learning your password. Browser extension audit
Object lock
A feature of object storage that keeps each stored version in a write-once state until a set date. Ransomware-proof backups
OCSP
Online Certificate Status Protocol: a way to ask a certificate authority whether a certificate has been revoked. HTTPS done properly
Offboarding
The steps that remove a person’s access, accounts and devices when they leave or change role. Security baseline for small teams
OIDC
OpenID Connect, an identity layer that lets a pipeline or user prove who it is with a signed token. Secrets management
Open-weight
Describes a model whose trained parameters are published for download; the licence may still restrict use. Local LLM runners compared
Open-weight model
A model whose trained parameters are published for download, so you can run it yourself; its licence may still restrict use. Where your prompts go
ORM
Object relational mapper: a library that maps database tables to objects and generates SQL. SQL injection and XSS
Output encoding
Converting characters with special meaning in a given context, such as HTML or a URL, into a harmless representation. SQL injection and XSS
Passkey
A FIDO credential based on a key pair that signs you in without a password and only works on the site it was created for. Multi-factor authentication compared
Passphrase
A password made of several randomly chosen words, long but easy to type. Strong passwords and passphrases
Password shucking
An attack that strips an outer hash layer by matching an inner, unkeyed hash against leaked hashes from elsewhere. Password hashing compared
Patch
An update that fixes a bug or a vulnerability.
Patch Tuesday
Microsoft’s regular monthly security release on the second Tuesday of each month. Patch management for small teams
Path traversal
An attack that uses sequences such as ../ to reach files outside the directory a server is meant to serve. Web servers compared
Pepper
A secret added to all password hashes and stored outside the database. Password hashing compared
Phishing
Messages that trick people into revealing credentials, paying money or running malware.
Platform as a service
A hosting model where you deploy application code and the provider runs and patches the servers underneath. Shared hosting, VPS or managed
Pre-commit hook
A script that git runs before it records a commit, able to stop the commit. Secrets management
Prepared statement
A query sent with placeholders, so that values are bound separately and never parsed as SQL. SQL injection and XSS
Prompt injection
Text that makes a language model follow instructions its operator or user did not intend. Prompt injection
Provenance
Verifiable information about how, where and from which source an artefact was built. Software supply chain security
Punycode
The ASCII encoding of an internationalised domain name, recognisable by the prefix xn--. Phishing signals when the grammar is perfect
Push protection
A code host feature that rejects a push containing a recognised credential before it reaches the repository. Secrets management
Quishing
Phishing that delivers its link through a QR code instead of clickable text. Phishing signals when the grammar is perfect
Ransomware
Malware that encrypts or steals data and demands payment.
Recovery key
A 48-digit number that opens a BitLocker-encrypted drive when the normal sign-in or TPM check fails. Windows 11 hardening
Refresh token
A long-lived credential used only to obtain new short-lived access tokens. JWT security
Retention
How long a provider keeps your prompts, files, outputs and the logs about them. Where your prompts go
Retrieval-augmented generation
A technique that inserts passages from documents or databases into the prompt so the model can answer with them. Prompt injection
Reverse proxy
A server in front of an application that handles TLS, authentication and access rules before forwarding requests. Local LLM runners compared
Runner
A program that loads model weights and serves answers, usually through an HTTP API. Local LLM runners compared
Safe Browsing
Google's service listing known phishing and malware sites, used by several browsers to show warnings. Browsers compared for security
Safetensors
A file format for model weights that stores only tensors and metadata, not executable code. Local LLM runners compared
Safety number
Signal's code for a conversation that both people can compare to confirm no one has swapped the encryption keys. Secure messengers compared
Salt
A random value stored with each password hash so that equal passwords produce different hashes.
Sandbox
An isolated environment that limits what a program can access.
SAST
Static application security testing: tools that analyse source code for vulnerable patterns without running it. AI coding assistants
SBOM
Software bill of materials: a machine-readable list of the components and versions inside a piece of software. OWASP Top 10 explained
Secret chat
Telegram's optional one-to-one chat mode with end-to-end encryption, tied to a single device. Secure messengers compared
Secret Key
1Password's random 128-bit key that is combined with your account password to protect the vault. Password managers compared
Secret manager
A service that stores secrets encrypted, controls access per secret and logs every read. Secrets management
Secret scanning
Automatic search for keys, tokens and passwords in code, commits and configuration. AI coding assistants
Secure Enclave
A separate processor in Apple devices that protects keys and biometric data even if the main system is compromised. iOS and Android security compared
Security patch level
The date in Android settings that shows how recent the phone's security fixes are. iOS and Android security compared
SELinux
A label-based mandatory access control system, enforcing by default on Rocky Linux and AlmaLinux. Linux server distributions compared
SHA-256
A widely used cryptographic hash function from the SHA-2 family with a 256 bit digest.
Shared responsibility
The split of security duties between a provider and its customer, which differs for each hosting model. Shared hosting, VPS or managed
Sideloading
Installing an app from a source other than the platform's main app store. iOS and Android security compared
SIM swap
Fraud in which a criminal gets a mobile operator to move a victim’s phone number to a SIM card the criminal controls. Multi-factor authentication compared
Sink
A function or property in the browser that turns a string into markup or executable code. SQL injection and XSS
Site isolation
Running each website in its own operating system process so that a compromised page cannot read another site's data in memory. Browsers compared for security
Slopsquatting
Registering a package name that AI models tend to hallucinate, so that developers who trust the suggestion install malicious code. AI coding assistants
Smart App Control
A Windows 11 feature that blocks apps unless a Microsoft cloud service predicts they are safe or they carry a valid signature. Desktop operating systems compared
Social engineering
Manipulating people instead of machines, for example with a fake call from support.
Socket activation
A systemd feature where systemd listens on the port itself and starts the service when a connection arrives. SSH hardening
Special category data
Sensitive personal data such as health, religion or trade union membership, which needs extra protection under the GDPR. A one page AI usage policy for small teams
SPF
Sender Policy Framework: a DNS record that lists the servers allowed to send email for a domain. Website launch checklist
Split tunnelling
Sending only some traffic through the VPN and the rest directly to the internet. What a VPN protects, and what it does not
SRI
Subresource Integrity: a hash in the script or link tag that makes the browser reject a file whose content has changed. Static site security
SSRF
Server-side request forgery: tricking a server into sending requests to a destination chosen by the attacker, often an internal system. OWASP Top 10 explained
Stack trace
A detailed error report listing the files, functions and lines involved, useful in development and revealing in production. Website launch checklist
Standard user
A Windows account without administrator rights: it can use apps but cannot change system settings or install software for everyone. Windows 11 hardening
Static site generator
A tool that builds plain HTML files ahead of time, so the live server runs no application code. CMS security compared
Subdomain takeover
Claiming someone else's subdomain at a hosting provider because a DNS record still points there after the original site was removed. Static site security
System Integrity Protection
A macOS protection that prevents even administrators from changing core system files. macOS security settings worth checking
System prompt
Instructions from the developer that are placed before the user's input to shape the model's behaviour. Prompt injection
Tamper Protection
A Defender feature that blocks changes to key security settings, including attempts made through the registry or scripts. Windows 11 hardening
Threat model
A short answer to: what do we protect, from whom, and what happens if it fails.
Threat modelling
A structured review of a design to find what could go wrong and which controls prevent it. OWASP Top 10 explained
TLS
Transport Layer Security: the protocol behind HTTPS that encrypts and authenticates connections.
TOTP
Time-based one-time password: a short code generated by an app from a shared secret and the current time. Multi-factor authentication compared
TPM 2.0
Trusted Platform Module: a chip or firmware component that stores encryption keys and records whether the start-up process was tampered with. Desktop operating systems compared
Transparency log
An append-only public record of signing events that anyone can check. Software supply chain security
Typosquatting
Publishing a package under a name that differs slightly from a popular one, hoping for typing errors. Software supply chain security
Verified boot
A start-up check that confirms every part of the operating system is unmodified before it runs. Desktop operating systems compared
Versioning
Keeping earlier versions of a file or object when it is changed or deleted. Ransomware-proof backups
Vishing
Phishing by phone call, often by someone posing as a bank or help desk. Phishing signals when the grammar is perfect
VLAN
A virtual network segment that keeps groups of devices apart on the same physical network. Life after end of support
VPN
A virtual private network: an encrypted tunnel that carries your traffic to a server, which forwards it on your behalf. What a VPN protects, and what it does not
VPS
Virtual private server: a virtual machine with its own operating system that you rent from a provider. Shared hosting, VPS or managed
WAF
Web application firewall: a filter that inspects HTTP requests and blocks known attack patterns before they reach the application. WordPress hardening
WebAuthn
The web standard that lets browsers use passkeys and security keys for sign-in. Multi-factor authentication compared
Windows LAPS
A built-in Windows feature that gives each PC a unique, rotating local administrator password and stores it centrally. Windows 11 hardening
WireGuard
A modern, compact VPN protocol using current cryptography, available on all major platforms. What a VPN protects, and what it does not
Work factor
A tunable cost parameter that makes each hash calculation slower or more memory-hungry. Password hashing compared
WP-Cron
The WordPress task scheduler, which runs background jobs such as automatic updates when the site receives visits. WordPress hardening
XML-RPC
An older protocol for remote procedure calls that WordPress exposes through xmlrpc.php for remote publishing. WordPress hardening
XProtect
Apple's built-in malware detection, updated in the background through system data files. macOS security settings worth checking
Zero trust
An approach that verifies every request instead of trusting anything inside the network by default.
Zero-day
A vulnerability that is exploited before a fix is available.