Glossary Cybersecurity and networking, clearly explained

From Zero Trust to SDN: this glossary explains the terms that come up in every security and networking project — what each one means, how the technology works and what matters in practice.

#

3-2-1 backup rule explained simply

Three copies, two media types, one off-site: the 3-2-1 rule is the classic of data protection — today often as 3-2-1-1-0.

A

Air gap explained simply

An air gap separates systems physically or logically from the network — the hardest isolation for backups and critical environments.

API security explained simply

API security protects interfaces against abuse: discovery against shadow APIs, schema validation, authentication and limits.

Application Dependency Mapping explained simply

Application Dependency Mapping automatically captures which applications and systems actually communicate with one another and presents these relationships as a map. This article explains how it works and shows why reliable communication maps form the foundation of every microsegmentation and migration plan.

Attack Surface explained simply

The attack surface comprises every point through which attackers can reach a company's IT systems, data and processes. Knowing it fully and reducing it systematically lowers the likelihood of successful attacks while limiting the damage they can cause.

B

BGP (Border Gateway Protocol) explained simply

The Border Gateway Protocol connects the internet's autonomous systems into a global network. This article explains how BGP selects routes, which risks such as route hijacking exist and why network operators with their own infrastructure have more control over their paths.

Bot management explained simply

Bot management separates wanted from malicious bots — using behavioural analysis instead of rigid IP and user-agent lists.

Botnet explained simply

A botnet is a collection of hijacked devices that attackers control remotely from a central point, without the owners knowing. Criminals use the pooled computing power for DDoS attacks, spam campaigns and cryptomining, among other things, often as a bookable service.

Breach Containment explained simply

Breach containment refers to the ability to confine a successful attack to a small part of the network. Instead of relying on prevention alone, the approach follows the assume-breach principle: compromises happen, and what matters is how far they can spread.

Brute force attack explained simply

Brute force tries passwords systematically — from simple wordlists to distributed guessing against thousands of accounts.

BSI C5 explained simply

BSI C5 is the criteria catalogue for cloud security published by the German Federal Office for Information Security (BSI). With a C5 attestation, cloud providers demonstrate, after an independent audit, that their services meet a defined level of security.

C

CDN (Content Delivery Network) explained simply

A content delivery network serves web content via edge servers distributed around the world and thereby noticeably shortens load times. This article explains how caching and anycast work, what protective effect a CDN offers and where its limits lie.

CI/CD Security explained simply

CI/CD pipelines build and deliver software automatically, which makes them a target in their own right: whoever controls the pipeline controls the software. This article shows how to secure secrets, dependencies and artefacts, and why segmenting the build environment is part of it.

Cloud Detection and Response (CDR) explained simply

Cloud Detection and Response (CDR) detects ongoing attacks in cloud environments on the basis of telemetry from the control plane, identities and data flows. This article explains how it works and its typical scenarios, distinguishes CDR from EDR and shows how detection and containment work together.

Cloud Migration explained simply

Cloud migration refers to the planned relocation of applications and data into cloud environments. This article explains the 6R strategies, examines network and security aspects such as private connectivity and shows when lift-and-shift is worthwhile and when modernisation is the better choice.

Cloud Security explained simply

Cloud security covers all measures that protect data, applications and infrastructure in cloud environments against attacks and misconfigurations. This article explains the shared responsibility model, shows the key protection layers and describes how companies can use the cloud securely and in line with regulations.

Cloud Workload Protection (CWPP) explained simply

Cloud Workload Protection Platforms (CWPP) protect virtual machines, containers and serverless functions across their entire lifecycle. This article explains how they work and where they are used, shows the difference from CSPM and describes why visibility and segmentation form the core of effective workload protection.

Colocation explained simply

Colocation means: your own hardware in someone else’s data center — with professional infrastructure and direct cloud onramps.

Common Criteria explained simply

Common Criteria is the international standard for evaluating and certifying the security properties of IT products. This article explains protection profiles and the evaluation assurance levels EAL1 through EAL7, describes the role of the BSI and shows how this product standard differs from ISO 27001.

Container Orchestration explained simply

Container orchestration automates the distribution, scaling and self-healing of containerized applications across many servers. This article explains the core functions, the role of Kubernetes as the de facto standard, typical use cases and the distinction between the orchestrator and the container runtime.

Container Security explained simply

Container security protects applications from the image build through the registry to runtime. This article explains scanning, signatures, minimal privileges and isolation, shows typical use cases and compares the security model of containers with that of virtual machines.

CVE and CVSS explained simply

CVE uniquely names known vulnerabilities, while CVSS rates their severity on a scale from 0 to 10. This article explains how the two systems work together, which metrics lie behind the score and why the CVSS value alone does not yet determine patch priority.

Cyber Resilience explained simply

Cyber resilience describes a company's ability to remain operational under attack and to recover quickly after disruptions. The approach combines prevention with containment and recovery, and thereby places the question of how operations survive an incident at the center.

Cyberattack explained simply

A cyberattack is a targeted attempt to gain unauthorized access to IT systems and cause damage there. Most attacks follow a recurring sequence that defenders can interrupt at several points if they know it.

Cybersecurity explained simply

Cybersecurity refers to all technical and organizational measures to protect IT systems and data against attacks and misuse. At its center are the protection goals of confidentiality, integrity and availability, implemented through disciplines ranging from network security to identity protection.

Cybersecurity Compliance explained simply

Cybersecurity compliance refers to the demonstrable adherence to legal and contractual security requirements, from the GDPR through NIS2 and DORA to ISO 27001. This article classifies the most important frameworks, describes evidence and audits and explains why compliance and actual security are two different goals.

D

DDoS Attack explained simply

A DDoS attack floods servers, websites or entire networks with massive volumes of requests until regular users can no longer gain access. Read how these attacks work, which variants exist and how you can secure the availability of your services.

Deepfake & vishing explained simply

Cloned voices and fake videos make fraud credible: the call from the boss is no longer proof — processes must carry the weight.

DevSecOps explained simply

DevSecOps embeds security directly into the development cycle: as a shared responsibility of development, operations, and security, driven by automation. This article explains how the approach works, how it differs from DevOps, and what role the underlying infrastructure plays.

DNS Security explained simply

The Domain Name System governs practically every connection on the internet, yet it was designed without security mechanisms. This article shows how attacks such as cache poisoning and DNS tunneling work and how DNSSEC and Protective DNS guard against them.

DORA (Digital Operational Resilience Act) explained simply

DORA is the EU regulation for digital operational resilience in the financial sector, binding since January 2025. It obliges financial entities and their ICT service providers to maintain resilient risk management, incident reporting, resilience testing, and managed third-party risk.

E

Edge computing explained simply

Edge computing processes data close to where it originates — for latencies central clouds cannot deliver.

Egress Costs explained simply

Egress costs are fees that cloud providers charge for outbound data traffic, and they rank among the hardest items of the cloud bill to plan for. This article explains how they arise, which architectures drive them, and which levers companies can use to reduce them.

Endpoint Detection and Response (EDR) explained simply

Endpoint Detection and Response (EDR) continuously records activity on endpoints, detects suspicious sequences within it, and enables fast countermeasures such as isolating affected systems during an incident. This article explains how EDR works and distinguishes the technology from classic antivirus and from XDR.

Endpoint Security explained simply

Endpoint security protects notebooks, servers, smartphones, and other devices against malware and unauthorized access. This article explains the evolution from classic antivirus to EPP and EDR, the role of hardening and patch management, and how endpoint security and network security complement each other.

EU AI Act explained simply

The EU AI Act regulates AI by risk: from prohibited practices via high-risk duties to transparency rules.

F

Firewall explained simply

The firewall controls data traffic between networks and blocks unwanted connections according to clear rules. Learn which firewall types exist, what modern systems can do, and why protection at the network edge today must be complemented by Zero Trust concepts.

Frontier AI explained simply

Frontier AI refers to the most capable generation of large AI models at the edge of what is technically feasible. For IT security, these models are tool and risk at once, because defenders and attackers draw on the same capabilities.

G

GitOps explained simply

GitOps makes Git the single source of truth for infrastructure and applications: the target state resides versioned in the repository, and agents continuously reconcile it with reality. This article explains the pull principle together with its audit advantages and the difference from classic CI/CD deployment.

GPT-5.4-Cyber (ChatGPT Cyber) explained simply

GPT-5.4-Cyber is OpenAI's AI model specialised in cybersecurity, colloquially often called ChatGPT Cyber. It supports vulnerability discovery, code analysis and incident response and is available to defenders through a controlled access programme.

H

Hypervisor explained simply

A hypervisor runs several virtual machines in isolation on shared hardware and forms the foundation of server virtualization, private clouds, VDI, and many cloud services. This article explains type 1 and type 2 hypervisors, central security questions from isolation to hypervisor-based segmentation, and the distinction from container runtimes.

I

Incident Response explained simply

Incident response refers to the structured process by which companies detect security incidents and resolve them in a controlled manner. A well-practiced procedure with clear roles and proven playbooks decides whether an incident stays a footnote or paralyzes operations for weeks.

Infrastructure as Code (IaC) explained simply

Infrastructure as Code describes servers, networks, and cloud resources in versioned configuration files from which environments are created automatically. This article explains declarative and imperative approaches, dealing with drift, and security scans for templates, including how it differs from configuration management.

ISO 27001 explained simply

ISO 27001 is the leading international standard for information security management systems (ISMS). Companies get certified against it to demonstrate verifiably to customers, partners, and regulators that information security is managed systematically.

K

Kubernetes Security explained simply

Kubernetes security covers all layers of a cluster: images, pods, network policies, RBAC, and secrets. This article explains how the protective layers interlock, why default values rarely suffice, and where microsegmentation goes beyond what NetworkPolicies can do.

L

Latency and Jitter explained simply

Latency describes the travel time of data packets in the network, jitter their variation. This article explains how both quantities arise, why VoIP and video are especially sensitive, and which measures let companies noticeably improve response times.

Lateral Movement explained simply

Lateral movement refers to techniques with which attackers work their way from system to system through a network after the initial breach. The goal is to expand privileges, find sensitive data, and ultimately bring critical systems under control.

Least privilege explained simply

Least privilege means: every identity gets only the rights it really needs — and only for as long as necessary.

M

Malware explained simply

Malware is the umbrella term for software that deliberately causes harm: from data theft to the encryption of entire systems. The main types differ in their distribution path and goal, with direct consequences for the appropriate defense strategy.

MDM & UEM explained simply

MDM manages mobile devices, UEM all endpoints from one console — and supplies device state for Zero Trust decisions.

Microsegmentation explained simply

Microsegmentation divides networks into the smallest zones and controls the data traffic between individual workloads, independently of IP addresses and VLANs. The approach stops lateral movement by attackers and is regarded as a core building block of every Zero Trust architecture.

MITRE ATT&CK explained simply

MITRE ATT&CK is the catalogue of real attacker tactics and techniques — the shared language for detection and defence.

MPLS explained simply

MPLS forwards data packets based on labels over fixed paths and was for years the standard for connecting company sites. This article explains how the technology works and its strengths, shows its limits in the cloud era, and clarifies when SD-WAN is the better choice.

Multi-Factor Authentication (MFA) explained simply

Multi-factor authentication combines at least two independent proofs from knowledge, possession, and biometrics, and thereby renders stolen passwords largely worthless. This article explains methods from TOTP to passkeys, their phishing resistance, and how they differ from 2FA.

Mythos (Claude Mythos) explained simply

Mythos is Anthropic's most powerful AI model, with autonomous offensive security capabilities that mark a turning point: vulnerability discovery, exploit development, and attack chains run at large scale for the first time without human involvement. The term therefore stands in for a new threat landscape.

N

Network Access Control (NAC) explained simply

Network Access Control (NAC) decides at the access point which users and devices are allowed to connect to the enterprise network. This article explains authentication via 802.1X and the assessment of device state, and shows how guest and BYOD access are cleanly separated and how NAC differs from ZTNA.

Network as a Service (NaaS) explained simply

With Network as a Service, a provider designs, delivers and operates the corporate network as an ongoing service — predictable costs, binding SLAs and 24/7 operations instead of own hardware and staffing.

Network Security explained simply

Network security protects a company's communication paths, from the internet connection through the internal network to the individual application. This article explains the key protective layers, shows typical deployment scenarios, and puts into context how modern concepts such as Zero Trust help.

Network Segmentation explained simply

Network segmentation divides a company network into separate areas, each with its own access rules and security levels. Incidents, disruptions, and unauthorized access are thus confined to individual zones instead of spreading unchecked across a company's entire network.

NIS-2 explained simply

NIS-2 is the EU directive for network and information security that obliges considerably more companies to adopt cybersecurity measures and reporting duties than its predecessor. It makes cybersecurity a demonstrable duty of executive management.

O

Observability explained simply

Observability refers to the ability to infer the internal state of IT systems from their outputs, above all from logs, metrics, and traces. This article explains these data types and the difference from traditional monitoring, and shows why observability is gaining importance for network operations and security analysis.

OT Security explained simply

OT security protects control and production systems in which availability takes priority, life cycles span decades, and patching is often barely possible. This article explains the differences from IT security, the Purdue model, and why segmentation is the central protective measure for production networks.

OWASP explained simply

OWASP is a non-profit organization that provides freely available standards, tools, and knowledge around application security. Best known are the OWASP Top 10, the list of the most critical risks for web applications.

P

Passkeys & FIDO2 explained simply

Passkeys replace passwords with cryptography: phishing-resistant, no secrets on servers — the new login standard.

PCI DSS explained simply

PCI DSS is the credit card industry's security standard for all companies that store, process, or transmit cardholder data. This article explains the core requirements, shows how network segmentation considerably reduces the audit scope, and distinguishes the standard from the GDPR.

Peering and Interconnection explained simply

Peering refers to the direct exchange of data traffic between two networks without a detour via transit providers. This article explains the difference between public peering at internet exchanges and private interconnects and shows why direct paths lower latency and costs and increase control over the data path.

Penetration Testing explained simply

A penetration test is a commissioned, controlled attack on one's own IT that uncovers exploitable vulnerabilities before real attackers find them. This article explains the goals, test types, and process, clarifies the legal basis, and distinguishes the pentest from the automated vulnerability scan.

Personal Data (PII) explained simply

Personal data is all information that can be assigned to an identified or identifiable person. This article explains the GDPR definition, the special categories, suitable technical and organizational protective measures, and the difference between PII and pseudonymized data.

Phishing explained simply

Phishing is the attempt to obtain credentials, money, or confidential information via forged messages. This article shows how such attacks proceed, which variants exist from spear phishing to business email compromise, and with which measures companies effectively limit the damage.

Post-Quantum Cryptography (PQC) explained simply

Post-quantum cryptography covers encryption and signature methods that withstand attacks from quantum computers as well. Because data intercepted today can be decrypted later, migration does not begin with the first quantum computer but now.

Prompt injection explained simply

Prompt injection smuggles instructions into AI systems — the most important new attack class for LLM applications.

R

Ransomware explained simply

Ransomware encrypts data and systems to extort a ransom, paralyzing entire companies in the process. This article explains how such attacks unfold, why backups alone save no one, and which measures let you limit damage effectively.

Role-Based Access Control (RBAC) explained simply

Role-Based Access Control (RBAC) grants permissions through roles instead of individual rights per person. This keeps access control auditable even in large environments, and it lets you enforce least privilege in everyday operation, from the cloud platform to the network policy.

RTO & RPO explained simply

RTO says how fast a system must run again; RPO how much data loss is bearable — the two levers of any DR planning.

S

SASE/SSE explained simply

SASE/SSE shifts network and security functions into a shared cloud platform that serves users and sites at the nearest access point. Building blocks such as ZTNA, Secure Web Gateway, CASB and Firewall as a Service replace the central appliance in the data center.

SD-WAN (Software-Defined WAN) explained simply

SD-WAN controls site connectivity in software: traffic automatically takes the best path over internet, fibre or mobile — centrally managed, encrypted and more flexible than rigid MPLS lines.

Security Breach explained simply

A security breach occurs when protective measures have actually been broken through and unauthorized parties have gained access to systems or data. The term is narrower than that of an incident and triggers concrete obligations, from the GDPR report within 72 hours to informing those affected.

Security Operations Center (SOC) explained simply

A security operations center continuously monitors the IT environment, assesses alerts and responds to incidents before anomalies turn into larger damage. This article explains tasks, roles and tools as well as the decision between an internal and a managed SOC.

Security Policy explained simply

A security policy defines in a binding way how a company handles information, systems and access. It ranges from the management directive to the technical segmentation rule and takes effect only when both levels fit together and are enforced.

Shift-Left Security explained simply

Shift-left security moves security checks to the start of software development: vulnerabilities are found while the code is written instead of shortly before release. This article explains tools such as SAST and SCA and describes why security at runtime nevertheless remains indispensable.

SIEM explained simply

A SIEM collects log data from across the entire IT, links individual events into patterns and alerts on signs of attacks. This article explains how it works, the maintenance effort behind good detection rules, and the distinction from SOAR and XDR.

Social Engineering explained simply

Social engineering attacks people instead of technology: attackers gain trust, create pressure and get employees to release access or payments. This article shows the most important manipulation techniques, explains why they work, and describes protective measures built from processes and technology.

Software-Defined Networking (SDN) explained simply

Software-Defined Networking (SDN) separates the control of a network from the hardware that transports the data packets. Administrators define the behavior of the entire network centrally in software instead of configuring each device individually, which makes the network faster to adapt and more consistent.

SQL injection explained simply

SQL injection smuggles database commands through input fields — known for decades and still among the top risks.

Supply Chain Attack explained simply

In a supply chain attack, attackers compromise a supplier, a software update, or a component and use it to reach the systems of their actual targets. This article explains attack paths through software and service provider supply chains, the role of SBOMs, and the supply chain obligations arising from NIS-2.

T

Threat Intelligence explained simply

Threat intelligence is processed knowledge about attackers, their tools, and their infrastructure. Used correctly, it turns raw threat data into a basis for decisions: from prioritizing vulnerabilities to automatically blocking known attack infrastructure during live operations.

TISAX explained simply

TISAX is the automotive industry’s information security assessment: one assessment, recognised by all participants.

TLS/SSL explained simply

TLS is the standard protocol for encrypted connections on the internet and the technical successor to the historical SSL. This article explains how the handshake works, what role certificates play, when mTLS makes sense, and how transport encryption differs from a VPN.

V

Virtual Desktop Infrastructure (VDI) explained simply

Virtual Desktop Infrastructure (VDI) provides workplace desktops centrally in the data center, and users access them from almost any end device without the data leaving the central environment. This article explains how a VDI environment is built, along with its security advantages and limits, and draws the distinction from Desktop as a Service.

Visibility explained simply

Visibility refers to the continuously up-to-date view of the assets, communication relationships, and data flows of your own IT. Every effective security measure depends on this foundation: anyone who does not know which systems talk to one another can neither segment nor detect attacks.

VLAN explained simply

VLANs divide a physical network into logically separated segments at Layer 2, for example for guests, telephony, or production. This article explains tagging according to IEEE 802.1Q, typical use cases, and the limits of the technology when it comes to real security zones at the workload level.

VPN explained simply

A VPN builds an encrypted tunnel through public networks and thereby connects sites or individual devices to the company network. This article explains how it works, its forms of use, and the limits of the model when employees access distributed applications from anywhere.

Vulnerability Management explained simply

Vulnerability management detects security gaps in IT systems and ensures they are fixed before attackers exploit them. This article shows how the cycle of scanning, prioritizing and patching works, what role reachability and context play in the assessment, and where the difference to a penetration test lies.

W

X

Z

Zero Trust explained simply

Zero Trust is a security model that does not automatically trust any user, device, or service, regardless of whether the access comes from the corporate network or from outside. Every access is checked individually, strictly authenticated, and limited to the privileges required for the task.

Zero Trust Network Access (ZTNA) explained simply

Zero Trust Network Access (ZTNA) grants access to enterprise applications on the principle of check first, then connect. Instead of opening the entire network like a VPN, ZTNA connects each user specifically to individual applications after verifying identity, device, and context.

Zero-Day explained simply

A zero-day vulnerability is a security flaw for which no patch yet exists, because the vendor is unaware of it. Attackers exploit precisely this window, and traditional patch management inevitably comes up empty during this phase.

A term missing, or want to put a topic into practice in your own network? Talk to KAEMI.