The Codex

A well-resourced, patient adversary, usually nation-state backed, that infiltrates a target and quietly maintains access for months or years to spy or sabotage. Not smash-and-grab but a long, stealthy occupation. APT for short.

The Advanced Encryption Standard, the workhorse symmetric cipher that secures nearly everything from disk encryption to HTTPS. Fast, battle-tested since 2001, and with a 256-bit key comfortably beyond brute force for the foreseeable future.

Physically isolating a system from all networks so data can only cross by hand-carried media. The ultimate firewall for the crown jewels, though Stuxnet proved even air gaps can be leapt by a stray USB stick.

Encryption using a mathematically linked key pair: a public key anyone can use to encrypt, and a private key only the owner holds to decrypt. It solves key distribution and enables digital signatures.

Dangling something tempting, a free USB drive left in the parking lot, a pirated movie download, to lure a victim into an action that infects them. Curiosity becomes the payload delivery mechanism.

The Border Gateway Protocol stitches the internet together by deciding how traffic routes between the large networks that compose it. Powerful and alarmingly trust-based; one bad announcement can hijack or black-hole entire regions.

Authentication using physical or behavioral traits: fingerprints, faces, irises, even typing rhythm. Convenient and hard to forget, but unlike a password, you cannot reset your face once the template leaks.

The defenders: the analysts and engineers who monitor, detect, and respond to attacks, keeping the lights on and the intruders out. The steadfast counterpart to the red team in any security exercise.

An army of compromised devices, from PCs to smart cameras, secretly enrolled and controlled by one operator. Rented out to launch DDoS floods, send spam, or mine cryptocurrency. A puppet network at criminal scale.

Guessing a password, key, or PIN by trying every possible combination until one works. Crude but relentless; success is only a matter of time and compute. Rate limiting, lockouts, and long random secrets make it impractical.

Writing more data into a memory buffer than it can hold, spilling into adjacent memory and corrupting it. Skilled attackers overwrite return addresses to hijack execution and run their own code. The classic memory-safety bug.

A program that pays outside researchers for responsibly finding and reporting vulnerabilities, turning would-be adversaries into paid allies. Cheaper than a breach, and it scales your testing to a global crowd of hunters.

A hacking competition where players solve security puzzles or attack and defend systems to grab hidden tokens called flags. Equal parts sport, training ground, and recruiting fair for the security world. CTF for short.

A setting left dangerously wrong: a storage bucket open to the world, an over-broad permission, a default password unchanged. The leading cause of cloud data leaks, and almost always a customer error rather than a provider one.

Tools that continuously scan cloud environments for misconfigurations, risky permissions, and compliance drift, then flag or fix them. An automated inspector walking your ever-shifting cloud, looking for unlocked doors.

The infrastructure, often shortened to C2, that attackers use to send orders to and siphon data from compromised machines. Cutting the C2 link is a key goal of incident responders. The strings the puppeteer pulls.

Meeting the security and privacy requirements imposed by laws, regulations, standards, or contracts. Necessary but not sufficient: passing the audit proves you met a baseline, not that you are actually secure. Do not confuse the map for the territory.

A lightweight, portable package bundling an application with its dependencies so it runs the same everywhere. It shares the host kernel rather than emulating a whole machine, making it far leaner than a virtual machine.

Taking username-password pairs leaked from one breach and replaying them en masse against other sites, betting that people reuse passwords. Automated, cheap, and depressingly effective. MFA and breached-password checks blunt it.

Tricks a logged-in victim's browser into firing an unwanted request to a site they trust, riding their existing session to change a password or move funds without consent. Anti-CSRF tokens and SameSite cookies block it.

Injecting malicious JavaScript into a trusted web page so it executes in other visitors browsers, stealing sessions, keystrokes, or defacing content. It comes in stored, reflected, and DOM flavors; output encoding and a strong CSP shut it down.

Common Vulnerabilities and Exposures: the public catalog that assigns each disclosed flaw a unique ID like CVE-2021-44228, so the whole world can refer to the same bug unambiguously. The universal names for known weaknesses.

The Common Vulnerability Scoring System, which rates how severe a flaw is from 0 to 10 based on how easily it is exploited and how much damage it does. It helps teams triage which of a thousand patches to apply first.

Technologies and policies that detect and block sensitive data, card numbers, health records, source code, from leaving the organization by email, upload, or USB. A watchful net across the exits, catching leaks before they escape.

Layering multiple independent controls so that if one fails, others still stand. Like a castle with a moat, walls, and guards, no single breach hands over the keep. Redundancy elevated to strategy.

The Dynamic Host Configuration Protocol hands out IP addresses and network settings automatically as devices join, so nobody configures them by hand. Convenient, and a tempting spot for a rogue server to redirect victims.

A cryptographic seal made with a private key that anyone can verify with the matching public key, proving who authored a message and that it was not altered. Non-repudiation and integrity in a single stroke.

Overwhelming a server, service, or network with a flood of traffic from thousands of hijacked machines until legitimate users cannot get through. Not a break-in but a digital stampede that jams the doors shut.

The internet's phone book, translating human-friendly names like example.com into the numeric IP addresses machines actually use. Ubiquitous and trusted, which is precisely why attackers love to poison, hijack, and tunnel through it.

Public-key crypto built on the algebra of elliptic curves, delivering security comparable to RSA with far smaller keys. Lean and fast, it powers modern TLS, messaging apps, and cryptocurrency wallets.

Software on laptops and servers that continuously records process, file, and network behavior, flags suspicious patterns, and lets responders investigate and isolate a compromised machine remotely. Antivirus grew up and started keeping a diary.

A measure of true randomness and unpredictability. High-entropy keys and passwords are hard to guess; low-entropy ones fall fast. Weak random number generators have doomed otherwise-solid cryptography more than once.

Linking identity across organizational or system boundaries so a user authenticated in one domain is trusted in another without a separate account. It is what lets your company login open a partner tool. Trust, delegated across borders.

Malware that lives in memory and abuses legitimate built-in tools like PowerShell instead of writing files to disk, leaving little for traditional antivirus to scan. Hard to catch, and it often vanishes on reboot.

A gatekeeper that filters network traffic against a rulebook, permitting trusted packets and blocking the rest. From simple port blockers to next-gen boxes that inspect application content, it is the classic perimeter guard of any network.

A property where each session uses a fresh ephemeral key, so even if a server's long-term private key is later stolen, previously recorded conversations stay unreadable. Yesterday's secrets survive tomorrow's breach.

The European Union General Data Protection Regulation, a sweeping privacy law granting individuals rights over their personal data and imposing strict duties, plus eye-watering fines, on those who handle it. It reshaped data privacy worldwide.

Originally a clever, curious tinkerer who makes systems do unintended things, not inherently a criminal. Popular usage muddied the word, so the community coined hat colors, white, black, and gray, to mark intent. Skill is neutral; ethics vary.

A one-way function that squeezes any input into a fixed-length fingerprint. The same input always yields the same digest, but you cannot reverse it back to the original. The backbone of integrity checks and password storage.

A hash-based message authentication code that combines a secret key with a hash function to prove both the integrity and the authenticity of a message. If the tag matches, an outsider did not tamper with the data.

A deliberately vulnerable-looking decoy system planted to lure attackers, waste their time, and quietly record their every move. Any interaction with it is inherently suspicious, which makes it a wonderfully low-noise early-warning trap.

The discipline and tooling for managing digital identities and what they may do: provisioning accounts, enforcing authentication, and governing permissions across an organization. The front door and the key-cutting shop combined.

The organized plan and process for handling a security breach: detect, contain, eradicate, recover, and learn. A rehearsed playbook that turns a panicked scramble into a calm, coordinated response when, not if, something goes wrong.

Defining servers, networks, and cloud resources in version-controlled config files rather than clicking through consoles. Reproducible, reviewable, and auditable, though a single bad template can now provision insecurity at scale.

A risk originating from within: an employee, contractor, or partner who abuses legitimate access, whether maliciously or through sheer carelessness. Hard to defend against because they are already inside the walls and already trusted.

A tripwire for networks and hosts that watches traffic and activity for known attack signatures or anomalies, then raises an alarm. It notices the break-in but, unlike a prevention system, does not stop it.

A detection system with teeth: it not only spots malicious traffic but actively blocks or drops it inline, sitting directly in the data path to stop attacks in real time before they reach their target.

The leading international standard for an Information Security Management System, specifying how to systematically manage information risk. Organizations get certified against it to prove, on paper and to auditors, that their security is deliberate.

A compact, signed token, JWT for short, that carries claims about a user between parties as a base64 string. Widely used for stateless authentication, though sloppy validation of its signature is a recurring source of bugs.

A tool, either software or hardware, that silently records every keystroke you type, harvesting passwords, private messages, and card numbers. What you type in confidence, it faithfully copies for someone else.

The dominant open-source system for orchestrating containers at scale: scheduling them, healing failures, and scaling on demand across clusters of machines. Powerful, sprawling, and with more than enough knobs to misconfigure spectacularly.

Give every user, process, and service exactly the access it needs to do its job and not a scrap more. This shrinks the blast radius when something is compromised. A cornerstone of sane security design.

Malicious code that lies dormant until a trigger fires, a specific date, a missing name in payroll, a certain file count, then detonates its payload. A booby trap, sometimes planted by a disgruntled insider for revenge.

An eavesdropper secretly relays and possibly alters traffic between two parties who believe they are talking directly. On open Wi-Fi or with forged certificates, the attacker can read and rewrite everything in transit. TLS is the main defense.

Requiring two or more independent proofs of identity: something you know, something you have, and something you are. Even if your password leaks, the attacker still lacks the second factor. The cheapest big win in security.

Network Address Translation lets many devices share one public IP by rewriting addresses at the router. It conserves scarce IPv4 space and, as a side effect, hides internal machines from direct inbound contact.

Dividing a network into isolated zones so a breach in one cannot freely spread to the rest. It contains lateral movement and keeps sensitive systems walled off from the general population. Fire doors for your infrastructure.

A widely adopted voluntary framework from the US agency NIST that organizes security work into core functions, originally Identify, Protect, Detect, Respond, and Recover, with Govern added later. A common language for managing cyber risk.

An authorization framework that lets you grant an app limited access to your data on another service without handing over your password. The Sign in with buttons and the delegated access behind them run on it.

An identity layer built on top of OAuth that adds authentication, letting apps verify who you are and fetch basic profile info via signed tokens. OAuth answers what you can do; OIDC answers who you are.

Operational Security: the practice of protecting small, seemingly harmless pieces of information that an adversary could piece together into something dangerous. Loose posts sink ships. Think before you share.

Open-Source Intelligence: gathering usable information from publicly available sources like social media, public records, and company websites. Attackers use it to profile targets before striking; defenders use it to see what they are exposing.

The fundamental unit of network data: a small chunk of your message wrapped with headers listing where it came from and where it is going. Millions of them, reassembled at the far end, make up every download.

A passwordless credential based on public-key cryptography that lives on your device and unlocks with a fingerprint, face, or PIN. Nothing secret is sent to the server, so there is nothing for phishers to steal. The password successor.

The disciplined process of tracking, testing, and deploying software updates to close known vulnerabilities before attackers exploit them. Boring, thankless, and one of the single most effective defenses there is.

Fraudulent messages that impersonate a trusted sender to trick you into surrendering passwords, clicking malware, or wiring money. The classic bait-and-hook of the internet: cast a wide net of fake emails and reel in whoever bites.

A numbered doorway on a device that directs traffic to the right service: 443 for HTTPS, 22 for SSH, 53 for DNS. Scanning which ports stand open is often the opening move of an attack.

A new generation of algorithms designed to withstand attacks from future quantum computers, which could shatter RSA and elliptic-curve crypto. Standardization is underway now so we migrate before harvest-now-decrypt-later attacks ever pay off.

Inventing a believable backstory, a fake IT tech, an auditor, a nervous new hire, to gain trust and coax out information or access. The con-artist stagecraft that makes so much social engineering actually work.

Turning a toehold into a takeover: exploiting a bug or misconfiguration to gain higher permissions than you were granted. Vertical escalation reaches admin or root; horizontal escalation hops sideways into another account at the same level.

Controls that tightly govern powerful admin and root accounts: vaulting their credentials, granting access just in time, and recording every session. Because the keys to the kingdom deserve their own guarded vault.

An intermediary that relays requests on behalf of clients or servers, able to cache content, filter traffic, hide origins, or inspect data as it passes through. A middleman you deploy on purpose.

The system of certificate authorities, certificates, and keys that lets strangers trust each other online. It binds a public key to an identity so your browser can verify a website really is who it claims to be.

Not a separate squad so much as a mindset, red and blue working together and sharing findings in real time so that every simulated attack immediately sharpens the defense. Collaboration over competition.

Malware that encrypts your files and demands payment for the key, often with a ticking clock and threats to leak stolen data. It turned cybercrime into a billion-dollar extortion industry. Offline backups are the best insurance.

The offensive squad that plays the adversary, mounting realistic attacks to test how an organization would hold up against a genuine intruder. Their job is to break in first so the defenders learn where they are weak.

A Trojan that hands the attacker hidden remote control of your machine: files, webcam, microphone, keystrokes, all of it. Like unauthorized tech support that never logs off, and often the first tool dropped in a targeted intrusion.

Every attacker's trophy: a flaw that lets them run arbitrary commands on a target machine from afar, effectively owning it. It is often the endgame of chaining smaller bugs together, and ranks among the most severe vulnerabilities.

The ethical practice of privately reporting a vulnerability to its owner and giving them reasonable time to fix it before going public. It balances the researcher's urge to publish against the public's need to stay safe.

The structured process of identifying threats, judging how likely and how damaging each is, and deciding what to accept, mitigate, transfer, or avoid. Because you cannot protect everything equally, so you spend where it matters most.

Granting permissions to roles rather than to individuals, then assigning people to roles. A nurse role, a manager role, an admin role: change someone's job and you simply swap their role. Access control that scales.

Stealth malware that burrows deep into the operating system, or even below it, to hide its presence and grant attackers persistent, privileged control. Notoriously hard to remove because it corrupts the very tools you would use to find it.

A foundational public-key algorithm whose security rests on the difficulty of factoring enormous numbers. It has powered encryption and digital signatures for decades, though its large keys are slowly ceding ground to elliptic-curve methods.

A unique random value mixed into a password before hashing so that identical passwords produce different digests. It defeats precomputed rainbow tables and forces attackers to crack each hash individually. Cheap, essential seasoning.

Security Assertion Markup Language, an XML-based standard that passes authentication assertions between an identity provider and an application. The enterprise workhorse behind much of corporate single sign-on.

Running untrusted code in an isolated, disposable environment where it can do no harm to the real system. Malware analysts detonate samples here; browsers and apps use it to contain misbehavior. A padded cell for programs.

A derisive term for an unskilled attacker who runs prebuilt tools and exploits written by others without truly understanding them. Dangerous mostly through sheer volume and luck rather than craft. Everyone starts somewhere, though.

Securely storing, distributing, and rotating sensitive credentials like API keys, tokens, and database passwords, keeping them out of source code and config files. Because a hardcoded secret in a public repo is a breach waiting to happen.

Training that turns everyday employees into a human firewall, teaching them to spot phishing, handle data safely, and report anything odd. People are the most exploited attack surface, and also the most improvable one.

Tricking a server into making requests chosen by the attacker, often reaching internal systems the attacker cannot touch directly. A favorite for raiding cloud metadata endpoints and stealing credentials from behind the firewall.

A cloud model where you run code as functions and the provider handles all the servers, scaling, and provisioning invisibly. You pay per execution, not per idle machine. There are still servers; you just stop caring about them.

The cloud ground rules dividing security duties: the provider secures the infrastructure of the cloud, while you secure what you put in it, your data, configs, and access. Most breaches happen on the customer side of that line.

Security Information and Event Management: a central brain that ingests logs from across the environment, correlates them, and surfaces alerts so analysts can spot attacks hidden in the noise. The nerve center of most security operations.

One login that unlocks many applications, so users authenticate once and roam freely instead of juggling dozens of passwords. Convenient and safer when done right, but it also makes that one identity a prized target.

An audit report, based on trust criteria like security and availability, that a service provider commissions to show customers its controls are sound. In B2B software, it is the report everyone asks for before they sign.

Hacking people instead of computers: manipulating human trust, fear, and helpfulness to extract information or access. Why crack a password when you can simply convince someone to tell you it? The oldest exploit there is.

A machine-readable inventory of every component and dependency in a piece of software, an SBOM. When the next Log4j-style flaw drops, it tells you instantly whether you are affected and where. An ingredients label for code.

Phishing with a sniper scope. Instead of a mass blast, the attacker researches one target, then crafts a personalized lure referencing real colleagues, projects, or invoices, making the con far harder to spot and far more likely to land.

Software that covertly monitors and exfiltrates your activity, from browsing habits to banking credentials, usually without any hint it is there. It ranges from shady adware to nation-grade surveillance implants.

Slipping malicious SQL into an input field so a careless application runs it as a database command. A single unescaped quote can dump customer tables, bypass logins, or delete records. Parameterized queries are the cure.

A logical slice of a larger network, carved out with a mask to group related devices and control how traffic flows between them. The neighborhoods that make routing and segmentation manageable.

Compromising a trusted vendor, library, or update mechanism so the malware rides legitimate channels into many downstream victims at once. Poison the well upstream and everyone drinking from it gets hit, as the SolarWinds breach showed.

Encryption where the same secret key both locks and unlocks the data. Fast and efficient for bulk data, but both parties must first share that key securely, which is the perennial challenge it cannot solve on its own.

Physically slipping into a restricted area by following an authorized person through a door, often by looking busy or carrying boxes so they politely hold it open. Courtesy weaponized. No badge required.

The pair of protocols underpinning the internet: IP routes packets to the right address, while TCP guarantees they arrive complete and in the right order. The postal service and the delivery confirmation of cyberspace.

The person or group behind malicious activity, ranging from lone script kiddies to organized crime rings to nation-state agencies. A neutral term that focuses on capability and intent rather than assuming a hoodie in a basement.

Transport Layer Security, the protocol that puts the S in HTTPS. It encrypts data in transit, authenticates servers via certificates, and protects against eavesdropping and tampering. The padlock in your address bar.

Malware disguised as something desirable: a game, a cracked app, a helpful tool. Once you invite it in and run it, it unloads its hidden payload. Named for the wooden horse that fooled the city of Troy.

Malicious code that attaches itself to a legitimate file or program and spreads when that host is run, requiring a human to unwittingly execute it. The original digital pathogen, named for how it infects and replicates.

Voice phishing: scam phone calls that impersonate banks, tech support, or the boss to pressure victims into revealing information or making payments. The phone adds urgency and a human voice that email alone cannot.

A Virtual LAN partitions one physical switch into isolated logical networks, so devices can be grouped by function rather than location and kept from talking to each other. Segmentation without rewiring anything.

A Virtual Private Network wraps your traffic in an encrypted tunnel to a remote server, hiding it from local snoops and making you appear to connect from elsewhere. A private hallway through a public building.

Rather than chase the target directly, the attacker infects a website the target is known to visit, then waits for them to wander in and get compromised. Named for predators lurking near the pond where prey comes to drink.

A filter that sits in front of web apps, inspecting HTTP requests to block common attacks like injection and cross-site scripting before they reach the server. A bouncer trained specifically for web traffic.

Self-replicating malware that spreads across networks on its own, needing no host file and no human help. It exploits vulnerabilities to hop machine to machine, sometimes circling the globe in minutes, as WannaCry and Conficker did.

A security model that assumes no user or device is trustworthy by default, even inside the network. Every request must be authenticated, authorized, and encrypted. The mantra: never trust, always verify.

A vulnerability the vendor does not yet know about, so there are zero days of warning and no patch available. Exploits for them are prized by attackers and researchers alike, often traded for large sums before disclosure.