Foundations

• CIA Triad — Confidentiality, Integrity, Availability. The three properties every security control aims to preserve.
• Threat — A potential cause of unwanted impact (e.g. a ransomware gang).
• Vulnerability — A weakness that a threat could exploit (e.g. an unpatched server).
• Risk — The combination of likelihood × impact, given the threats and vulnerabilities you have.
• Control — A safeguard that reduces risk (e.g. MFA, firewall, encryption).

Attacks & Adversary Behavior

• Phishing — Tricking a user into clicking, opening, or revealing something via deceptive email or message.
• Ransomware — Malware that encrypts data and demands payment for the decryption key.
• Lateral movement — Pivoting from one compromised system to others inside the network.
• Privilege escalation — Gaining higher access than originally granted (user → admin).
• C2 (command and control) — The infrastructure attackers use to send instructions to compromised hosts.
• IOC (indicator of compromise) — A forensic artifact (hash, IP, domain) suggesting a system is compromised.
• TTP — Tactics, Techniques, and Procedures — the patterns of behavior an adversary uses.

Vulnerabilities & Exploits

• CVE — Common Vulnerabilities and Exposures: a public registry of known software vulnerabilities, each with a unique ID like CVE-2026-12345.
• CVSS — A 0–10 score reflecting a vulnerability's severity.
• Zero-day — A vulnerability that's actively exploited before a patch is available.
• Exploit — Code or technique that takes advantage of a vulnerability.
• Patch — A fix issued by the vendor that closes the vulnerability.

Defenses & Architecture

• MFA — Multi-factor authentication: requiring a second factor (phone, key) beyond a password.
• SSO — Single sign-on: one identity provider handles authentication for many apps.
• Zero Trust — A model where no user or device is trusted by default; every access is verified.
• Least privilege — Giving each user/service only the access strictly required.
• EDR / XDR — Endpoint (or extended) detection & response: agents that watch for malicious behavior on endpoints.
• SIEM — Security Information and Event Management: a platform that ingests logs and runs detection rules.
• SOC — Security Operations Center: the team that watches alerts 24×7.
• WAF — Web Application Firewall: filters HTTP requests to block common web attacks.