Intel

Quick reference

Abbreviations

Roles and agencies

CISO Chief Information Security Officer
Executive accountable for the security program.
CISA Cybersecurity and Infrastructure Security Agency
U.S. civilian cybersecurity agency.
NIST National Institute of Standards and Technology
U.S. standards body behind CSF, SP 800 series, FIPS.
OWASP Open Worldwide Application Security Project
Community resources for application security (Top 10, ASVS).

Crypto and network

VPN Virtual Private Network
Encrypted tunnel between networks or a user and a network.
TLS / HTTPS Transport Layer Security / HTTP Secure
Encryption in transit for web and many other protocols.
IPsec Internet Protocol Security
Network-layer encryption (common in site-to-site VPNs).
PKI / CA Public Key Infrastructure / Certificate Authority
Trust model for certificates and digital signatures.
SPF / DKIM / DMARC Sender Policy Framework / DomainKeys Identified Mail / Domain-based Message Authentication, Reporting and Conformance
Email authentication to reduce spoofing.
DNSSEC Domain Name System Security Extensions
Cryptographic authenticity for DNS records.

Frameworks and compliance

NIST CSF NIST Cybersecurity Framework
Govern, Identify, Protect, Detect, Respond, Recover.
NIST SP 800-53 Security and Privacy Controls
Catalog of controls used by U.S. federal systems and many enterprises.
RMF Risk Management Framework
NIST process to categorize, select, implement, assess, authorize, monitor.
ISO 27001 Information Security Management System
International ISMS standard and certification.
CIS Center for Internet Security
CIS Controls and CIS Benchmarks (hardening guides).
PCI-DSS Payment Card Industry Data Security Standard
Controls required if you store/process/transmit card data.
GDPR / HIPAA / CMMC General Data Protection Regulation / Health Insurance Portability and Accountability Act / Cybersecurity Maturity Model Certification
Major privacy / healthcare / U.S. DoD contractor regimes.
SOC 2 System and Organization Controls 2
Independent report on security, availability, confidentiality, etc.
FIPS Federal Information Processing Standards
U.S. government crypto and security standards (e.g., FIPS 140).

Vulnerability IDs and scoring

CVE Common Vulnerabilities and Exposures
Unique public ID (CVE-YYYY-NNNNN). Identifier only—not a severity score.
CNA CVE Numbering Authority
Org allowed to assign CVEs (vendor, researcher, MITRE).
NVD National Vulnerability Database
NIST enrichment of CVE: scores, CWE, CPE, references.
CWE Common Weakness Enumeration
Type of flaw (CWE-79 XSS, CWE-89 SQLi, CWE-787 OOB write)—not the specific bug.
CPE Common Platform Enumeration
Machine-readable affected product/version string.
CVSS Common Vulnerability Scoring System
0.0–10.0 severity. v3.1 still dominates; v4.0 is increasing. Maintained by FIRST.
CVSS-B CVSS Base score
Theoretical impact only. Does not mean “being exploited.”
EPSS Exploit Prediction Scoring System
FIRST model: estimated chance of exploitation in the next 30 days. Use with CVSS, not instead of it.
KEV Known Exploited Vulnerabilities catalog
CISA list of CVEs with reliable evidence of in-the-wild exploitation plus a clear fix. Highest operational priority for most orgs.
SSVC Stakeholder-Specific Vulnerability Categorization
CISA/SEI decision method (Track / Attend / Act) using exploitation, impact, automatable, mission prevalence.
PoC Proof of Concept
Public demo exploit. Not the same as “exploited in the wild.”
0-day Zero-day
Exploited (or disclosed) before a vendor patch exists.
n-day N-day
Known CVE; patch exists but is unapplied. Most mass exploitation is n-day.
RCE Remote Code Execution
Attacker runs code on the target, usually over the network. Highest-impact class in headlines.
LPE / Privesc Local Privilege Escalation
Already on the box; becomes SYSTEM/root/admin.
Auth bypass Authentication bypass
Reach a function without valid credentials.
SSRF / XXE / IDOR Server-Side Request Forgery / XML External Entity / Insecure Direct Object Reference
Common web/API classes you will see in CVE titles.
UAF / OOB Use-After-Free / Out-of-Bounds
Memory-corruption primitives, frequent in browser/OS/VPN appliance CVEs.
GHSA / OSV GitHub Security Advisory / Open Source Vulnerabilities
Parallel IDs used for open-source packages.
CSAF / VEX Common Security Advisory Framework / Vulnerability Exploitability eXchange
Machine-readable “does this product actually need a patch?” statements.

CVSS vector

AV
Attack Vector — N Network, A Adjacent, L Local, P Physical
AC
Attack Complexity — L Low, H High
PR
Privileges Required — N None, L Low, H High
UI
User Interaction — N None, R Required
S
Scope — U Unchanged, C Changed
C / I / A
Confidentiality / Integrity / Availability impact — N / L / H

Operations

SOC Security Operations Center
Team/function that monitors, detects, and responds 24x7.
SIEM Security Information and Event Management
Aggregate, correlate, and alert on security logs.
SOAR Security Orchestration, Automation and Response
Playbooks that automate investigation and containment.
EDR / XDR / NDR Endpoint / Extended / Network Detection and Response
Detect and respond on hosts, across telemetry, or on the network.
IDS / IPS Intrusion Detection / Prevention System
Detect (and optionally block) known or anomalous traffic.
IR Incident Response
Process to contain, eradicate, and recover from a security event.
CSIRT / CIRT Computer Security / Cyber Incident Response Team
Designated IR team.
MDR Managed Detection and Response
Outsourced 24x7 detection and response service.
WAF Web Application Firewall
Filter HTTP(S) traffic to stop common web attacks.

Threat actor naming

APT + number Mandiant (and widely copied)
Nation-state or state-aligned long-term actor (APT28, APT29, APT41).
FIN + number Mandiant
Financially motivated cluster (FIN7, FIN11).
UNC + number Mandiant
Uncategorized activity cluster—not yet a named APT/FIN.
TEMP. Mandiant
Temporary internal name while a cluster is forming.
Storm-#### Microsoft
Emerging / not-yet-attributed cluster (replaced older DEV-####).
[Adjective] + weather Microsoft
Attributed family: Typhoon China, Blizzard Russia, Sleet DPRK, Sandstorm Iran, Tempest criminal, Flood influence, Tsunami commercial spyware vendors. Example: Salt Typhoon, Midnight Blizzard, Pistachio Tempest.
Animal + color CrowdStrike
Panda China, Bear Russia, Kitten Iran, Chollima DPRK, Spider e-crime, Jackal hacktivism.
G#### MITRE ATT&CK
Neutral group ID (e.g., G0016 = APT29). Best cross-reference.
TA### Proofpoint
Threat actor cluster (e.g., TA505).
TAG-## Recorded Future
Temporary attribution group.

Threat tradecraft

APT Advanced Persistent Threat
Well-resourced, long-dwell adversary (often nation-state).
TTP Tactics, Techniques, and Procedures
How the actor works; mapped to MITRE ATT&CK (T1190, T1059, etc.).
C2 / C&C Command and Control
Beaconing channel after implant.
IOC Indicator of Compromise
Hash, IP, domain, mutex, cert—brittle; TTPs last longer.
LotL / LOLBins / LOLBAS Living off the Land / Living-off-the-Land Binaries and Scripts
Abuse of signed OS tools (powershell, wmic, bitsadmin) to evade EDR.
BYOVD Bring Your Own Vulnerable Driver
Load a legit signed-but-vulnerable driver to disable EDR.
IAB Initial Access Broker
Sells VPN/RDP/web-shell access; ransomware affiliates buy it.
RaaS Ransomware as a Service
Operators build encryptor + leak site; affiliates run the intrusion and split payment.
DLS Data Leak Site
Tor site used to name victims and drip stolen files.
Double / triple extortion Encrypt + leak (+ DDoS or victim-customer harassment)
Why “we have backups” no longer ends the incident.
AiTM Adversary-in-the-Middle
Proxy phishing that steals session cookies and bypasses MFA.
BEC Business Email Compromise
Payment fraud via mailbox / vendor impersonation.
Infostealer Credential/cookie stealer
RedLine, Lumma, etc.; often the real initial access before ransomware.
Web shell Persistent HTTP backdoor on a server
Common after Exchange/VPN/file-transfer appliance exploitation.
Loader / dropper / stager / RAT Delivery stages
Loader fetches payload; RAT is the interactive backdoor.
Wiper Destructive malware
Not for ransom; used in geopolitical attacks.
Supply chain Compromise of software/update/vendor
SolarWinds-style; one CVE or build system, many downstream victims.
DDoS Distributed Denial of Service
Overwhelm a service with traffic from many sources.
XSS / CSRF / SQLi Cross-Site Scripting / Cross-Site Request Forgery / SQL Injection
Common web application attack classes.

Identity

IAM Identity and Access Management
People, devices, and services: who they are and what they can do.
MFA / 2FA Multi-Factor / Two-Factor Authentication
Two or more independent factors (know / have / are).
SSO Single Sign-On
One authenticated session used across multiple apps.
PAM Privileged Access Management
Control, monitor, and vault admin / high-risk accounts.
RBAC / ABAC Role- / Attribute-Based Access Control
Access by job role vs. attributes (dept, device, risk).
IdP Identity Provider
System that authenticates users (Entra ID, Okta, AD FS).

Principles

CIA Confidentiality, Integrity, Availability
Foundational security triad: keep data private, unaltered, and usable when needed.
AAA Authentication, Authorization, Accounting
Prove identity, grant least privilege, and log activity.
ZT / ZTA / ZTNA Zero Trust / Zero Trust Architecture / Zero Trust Network Access
Never trust by default; verify every request continuously.
DiD Defense in Depth
Layered controls so one failure does not cause total compromise.

Advisories and sharing

CSA
Cybersecurity Advisory (often multi-agency: CISA + FBI + NSA + Five Eyes).
AAYY-###
CISA alert number (e.g., AA23-320A).
BOD
Binding Operational Directive (U.S. civilian agencies; BOD 22-01 drives KEV patching).
FLASH / PIN
FBI short-form threat notice.
MAR
Malware Analysis Report (CISA).
ISAC
Information Sharing and Analysis Center (sector sharing).

Software, cloud, security products

SKU Stock Keeping Unit
A specific licensed capability pack—same product family, different features and price.