Services

SASE/SSE – Zero Trust Network Access Secure access for users and sites: ZTNA instead of VPN.
Zero Trust Microsegmentation Stop lateral movement and contain attacks, down to the workload.
Application Security Protect web apps and APIs: WAF, DDoS mitigation, bot management.
Compute & AI Compute and AI at the edge: close to users, quick to scale.
Software Defined WAN Connect sites flexibly and resiliently, managed centrally.
Software Defined LAN Campus and branch networks from the cloud: managed switching and Wi-Fi.
China Connectivity Reliable connectivity between China and Europe: Global Acceleration and the China Network.
Cloud Connectivity & SDN Private paths to the cloud: onramps, multicloud routing and SDN platforms.
Professional & Managed Services Consulting, design and operations: from analysis to managed service.
Partners
Support
Company

More from KAEMI

Why KAEMI? What sets us apart as a managed service partner.
About us Team, mission and the KAEMI story.
Leadership The people who lead KAEMI.
Careers Open positions and working at KAEMI.
Events Events, webinars and trade shows.
Resources Whitepapers, guides and downloads.

LatestAll posts →
Mutual TLS (mTLS): Wenn beide Seiten ihre Identität nachweisenHTTPS prüft nur den Server, mTLS prüft beide Seiten. Wie gegenseitige Authentifizierung funktioniert, welche Zertifikatskette dahintersteht, wovor sie schützt und worauf es bei der Einführung ankommt.Mikrosegmentierung: Was sie ist und warum sie laterale Angriffe stopptWie Mikrosegmentierung laterale Angriffe stoppt: Zero-Trust-Segmentierung verständlich erklärt, vom Ost-West-Verkehr über Umsetzungsansätze und Compliance bis zur Einführung mit Illumio und KAEMI.
Contact
Blog
DE EN

Glossary Cybersecurity and networking, clearly explained

From Zero Trust to SDN: this glossary explains the terms that keep coming up in security and networking projects. Every entry describes what a term means, how the technology works and what matters in practice.

A

Application Dependency Mapping

Application Dependency Mapping automatically captures which applications and systems actually communicate with one another and presents these relationships as a map. This article explains how it works and shows why reliable communication maps form the foundation of every microsegmentation and migration plan.

Attack Surface

The attack surface comprises every point through which attackers can reach a company's IT systems, data and processes. Knowing it fully and reducing it systematically lowers the likelihood of successful attacks while limiting the damage they can cause.

B

BGP (Border Gateway Protocol)

The Border Gateway Protocol connects the internet's autonomous systems into a global network. This article explains how BGP selects routes, which risks such as route hijacking exist and why network operators with their own infrastructure have more control over their paths.

Botnet

A botnet is a collection of hijacked devices that attackers control remotely from a central point, without the owners knowing. Criminals use the pooled computing power for DDoS attacks, spam campaigns and cryptomining, among other things, often as a bookable service.

Breach Containment

Breach containment refers to the ability to confine a successful attack to a small part of the network. Instead of relying on prevention alone, the approach follows the assume-breach principle: compromises happen, and what matters is how far they can spread.

BSI C5

BSI C5 is the criteria catalogue for cloud security published by the German Federal Office for Information Security (BSI). With a C5 attestation, cloud providers demonstrate, after an independent audit, that their services meet a defined level of security.

C

CDN (Content Delivery Network)

A content delivery network serves web content via edge servers distributed around the world and thereby noticeably shortens load times. This article explains how caching and anycast work, what protective effect a CDN offers and where its limits lie.

CI/CD Security

CI/CD pipelines build and deliver software automatically, which makes them a target in their own right: whoever controls the pipeline controls the software. This article shows how to secure secrets, dependencies and artefacts, and why segmenting the build environment is part of it.

Cloud Detection and Response (CDR)

Cloud Detection and Response (CDR) detects ongoing attacks in cloud environments on the basis of telemetry from the control plane, identities and data flows. This article explains how it works and its typical scenarios, distinguishes CDR from EDR and shows how detection and containment work together.

Cloud Migration

Cloud migration refers to the planned relocation of applications and data into cloud environments. This article explains the 6R strategies, examines network and security aspects such as private connectivity and shows when lift-and-shift is worthwhile and when modernisation is the better choice.

Cloud Security

Cloud security covers all measures that protect data, applications and infrastructure in cloud environments against attacks and misconfigurations. This article explains the shared responsibility model, shows the key protection layers and describes how companies can use the cloud securely and in line with regulations.

Cloud Workload Protection (CWPP)

Cloud Workload Protection Platforms (CWPP) protect virtual machines, containers and serverless functions across their entire lifecycle. This article explains how they work and where they are used, shows the difference from CSPM and describes why visibility and segmentation form the core of effective workload protection.

Common Criteria

Common Criteria is the international standard for evaluating and certifying the security properties of IT products. This article explains protection profiles and the evaluation assurance levels EAL1 through EAL7, describes the role of the BSI and shows how this product standard differs from ISO 27001.

Container Orchestration

Container orchestration automates the distribution, scaling and self-healing of containerized applications across many servers. This article explains the core functions, the role of Kubernetes as the de facto standard, typical use cases and the distinction between the orchestrator and the container runtime.

Container Security

Container security protects applications from the image build through the registry to runtime. This article explains scanning, signatures, minimal privileges and isolation, shows typical use cases and compares the security model of containers with that of virtual machines.

CVE and CVSS

CVE uniquely names known vulnerabilities, while CVSS rates their severity on a scale from 0 to 10. This article explains how the two systems work together, which metrics lie behind the score and why the CVSS value alone does not yet determine patch priority.

Cyber Resilience

Cyber resilience describes a company's ability to remain operational under attack and to recover quickly after disruptions. The approach combines prevention with containment and recovery, and thereby places the question of how operations survive an incident at the center.

Cyberattack

A cyberattack is a targeted attempt to gain unauthorized access to IT systems and cause damage there. Most attacks follow a recurring sequence that defenders can interrupt at several points if they know it.

Cybersecurity

Cybersecurity refers to all technical and organizational measures to protect IT systems and data against attacks and misuse. At its center are the protection goals of confidentiality, integrity and availability, implemented through disciplines ranging from network security to identity protection.

Cybersecurity Compliance

Cybersecurity compliance refers to the demonstrable adherence to legal and contractual security requirements, from the GDPR through NIS2 and DORA to ISO 27001. This article classifies the most important frameworks, describes evidence and audits and explains why compliance and actual security are two different goals.

D

DDoS Attack

A DDoS attack floods servers, websites or entire networks with massive volumes of requests until regular users can no longer gain access. Read how these attacks work, which variants exist and how you can secure the availability of your services.

DevSecOps

DevSecOps embeds security directly into the development cycle: as a shared responsibility of development, operations, and security, driven by automation. This article explains how the approach works, how it differs from DevOps, and what role the underlying infrastructure plays.

DNS Security

The Domain Name System governs practically every connection on the internet, yet it was designed without security mechanisms. This article shows how attacks such as cache poisoning and DNS tunneling work and how DNSSEC and Protective DNS guard against them.

DORA (Digital Operational Resilience Act)

DORA is the EU regulation for digital operational resilience in the financial sector, binding since January 2025. It obliges financial entities and their ICT service providers to maintain resilient risk management, incident reporting, resilience testing, and managed third-party risk.

E

Egress Costs

Egress costs are fees that cloud providers charge for outbound data traffic, and they rank among the hardest items of the cloud bill to plan for. This article explains how they arise, which architectures drive them, and which levers companies can use to reduce them.

Endpoint Detection and Response (EDR)

Endpoint Detection and Response (EDR) continuously records activity on endpoints, detects suspicious sequences within it, and enables fast countermeasures such as isolating affected systems during an incident. This article explains how EDR works and distinguishes the technology from classic antivirus and from XDR.

Endpoint Security

Endpoint security protects notebooks, servers, smartphones, and other devices against malware and unauthorized access. This article explains the evolution from classic antivirus to EPP and EDR, the role of hardening and patch management, and how endpoint security and network security complement each other.

F

Firewall

The firewall controls data traffic between networks and blocks unwanted connections according to clear rules. Learn which firewall types exist, what modern systems can do, and why protection at the network edge today must be complemented by Zero Trust concepts.

Frontier AI

Frontier AI refers to the most capable generation of large AI models at the edge of what is technically feasible. For IT security, these models are tool and risk at once, because defenders and attackers draw on the same capabilities.

G

GitOps

GitOps makes Git the single source of truth for infrastructure and applications: the target state resides versioned in the repository, and agents continuously reconcile it with reality. This article explains the pull principle together with its audit advantages and the difference from classic CI/CD deployment.

GPT-5.4-Cyber (ChatGPT Cyber)

GPT-5.4-Cyber is OpenAI's AI model specialised in cybersecurity, colloquially often called ChatGPT Cyber. It supports vulnerability discovery, code analysis and incident response and is available to defenders through a controlled access programme.

H

Hypervisor

A hypervisor runs several virtual machines in isolation on shared hardware and forms the foundation of server virtualization, private clouds, VDI, and many cloud services. This article explains type 1 and type 2 hypervisors, central security questions from isolation to hypervisor-based segmentation, and the distinction from container runtimes.

I

Incident Response

Incident response refers to the structured process by which companies detect security incidents and resolve them in a controlled manner. A well-practiced procedure with clear roles and proven playbooks decides whether an incident stays a footnote or paralyzes operations for weeks.

Infrastructure as Code (IaC)

Infrastructure as Code describes servers, networks, and cloud resources in versioned configuration files from which environments are created automatically. This article explains declarative and imperative approaches, dealing with drift, and security scans for templates, including how it differs from configuration management.

ISO 27001

ISO 27001 is the leading international standard for information security management systems (ISMS). Companies get certified against it to demonstrate verifiably to customers, partners, and regulators that information security is managed systematically.

K

Kubernetes Security

Kubernetes security covers all layers of a cluster: images, pods, network policies, RBAC, and secrets. This article explains how the protective layers interlock, why default values rarely suffice, and where microsegmentation goes beyond what NetworkPolicies can do.

L

Latency and Jitter

Latency describes the travel time of data packets in the network, jitter their variation. This article explains how both quantities arise, why VoIP and video are especially sensitive, and which measures let companies noticeably improve response times.

Lateral Movement

Lateral movement refers to techniques with which attackers work their way from system to system through a network after the initial breach. The goal is to expand privileges, find sensitive data, and ultimately bring critical systems under control.

M

Malware

Malware is the umbrella term for software that deliberately causes harm: from data theft to the encryption of entire systems. The main types differ in their distribution path and goal, with direct consequences for the appropriate defense strategy.

Microsegmentation

Microsegmentation divides networks into the smallest zones and controls the data traffic between individual workloads, independently of IP addresses and VLANs. The approach stops lateral movement by attackers and is regarded as a core building block of every Zero Trust architecture.

MPLS

MPLS forwards data packets based on labels over fixed paths and was for years the standard for connecting company sites. This article explains how the technology works and its strengths, shows its limits in the cloud era, and clarifies when SD-WAN is the better choice.

Multi-Factor Authentication (MFA)

Multi-factor authentication combines at least two independent proofs from knowledge, possession, and biometrics, and thereby renders stolen passwords largely worthless. This article explains methods from TOTP to passkeys, their phishing resistance, and how they differ from 2FA.

Mythos (Claude Mythos)

Mythos is Anthropic's most powerful AI model, with autonomous offensive security capabilities that mark a turning point: vulnerability discovery, exploit development, and attack chains run at large scale for the first time without human involvement. The term therefore stands in for a new threat landscape.

N

Network Access Control (NAC)

Network Access Control (NAC) decides at the access point which users and devices are allowed to connect to the enterprise network. This article explains authentication via 802.1X and the assessment of device state, and shows how guest and BYOD access are cleanly separated and how NAC differs from ZTNA.

Network Security

Network security protects a company's communication paths, from the internet connection through the internal network to the individual application. This article explains the key protective layers, shows typical deployment scenarios, and puts into context how modern concepts such as Zero Trust help.

Network Segmentation

Network segmentation divides a company network into separate areas, each with its own access rules and security levels. Incidents, disruptions, and unauthorized access are thus confined to individual zones instead of spreading unchecked across a company's entire network.

NIS-2

NIS-2 is the EU directive for network and information security that obliges considerably more companies to adopt cybersecurity measures and reporting duties than its predecessor. It makes cybersecurity a demonstrable duty of executive management.

O

Observability

Observability refers to the ability to infer the internal state of IT systems from their outputs, above all from logs, metrics, and traces. This article explains these data types and the difference from traditional monitoring, and shows why observability is gaining importance for network operations and security analysis.

OT Security

OT security protects control and production systems in which availability takes priority, life cycles span decades, and patching is often barely possible. This article explains the differences from IT security, the Purdue model, and why segmentation is the central protective measure for production networks.

OWASP

OWASP is a non-profit organization that provides freely available standards, tools, and knowledge around application security. Best known are the OWASP Top 10, the list of the most critical risks for web applications.

P

PCI DSS

PCI DSS is the credit card industry's security standard for all companies that store, process, or transmit cardholder data. This article explains the core requirements, shows how network segmentation considerably reduces the audit scope, and distinguishes the standard from the GDPR.

Peering and Interconnection

Peering refers to the direct exchange of data traffic between two networks without a detour via transit providers. This article explains the difference between public peering at internet exchanges and private interconnects and shows why direct paths lower latency and costs and increase control over the data path.

Penetration Testing

A penetration test is a commissioned, controlled attack on one's own IT that uncovers exploitable vulnerabilities before real attackers find them. This article explains the goals, test types, and process, clarifies the legal basis, and distinguishes the pentest from the automated vulnerability scan.

Personal Data (PII)

Personal data is all information that can be assigned to an identified or identifiable person. This article explains the GDPR definition, the special categories, suitable technical and organizational protective measures, and the difference between PII and pseudonymized data.

Phishing

Phishing is the attempt to obtain credentials, money, or confidential information via forged messages. This article shows how such attacks proceed, which variants exist from spear phishing to business email compromise, and with which measures companies effectively limit the damage.

Post-Quantum Cryptography (PQC)

Post-quantum cryptography covers encryption and signature methods that withstand attacks from quantum computers as well. Because data intercepted today can be decrypted later, migration does not begin with the first quantum computer but now.

R

Ransomware

Ransomware encrypts data and systems to extort a ransom, paralyzing entire companies in the process. This article explains how such attacks unfold, why backups alone save no one, and which measures let you limit damage effectively.

Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) grants permissions through roles instead of individual rights per person. This keeps access control auditable even in large environments, and it lets you enforce least privilege in everyday operation, from the cloud platform to the network policy.

S

SASE/SSE

SASE/SSE shifts network and security functions into a shared cloud platform that serves users and sites at the nearest access point. Building blocks such as ZTNA, Secure Web Gateway, CASB and Firewall as a Service replace the central appliance in the data center.

Security Breach

A security breach occurs when protective measures have actually been broken through and unauthorized parties have gained access to systems or data. The term is narrower than that of an incident and triggers concrete obligations, from the GDPR report within 72 hours to informing those affected.

Security Operations Center (SOC)

A security operations center continuously monitors the IT environment, assesses alerts and responds to incidents before anomalies turn into larger damage. This article explains tasks, roles and tools as well as the decision between an internal and a managed SOC.

Security Policy

A security policy defines in a binding way how a company handles information, systems and access. It ranges from the management directive to the technical segmentation rule and takes effect only when both levels fit together and are enforced.

Shift-Left Security

Shift-left security moves security checks to the start of software development: vulnerabilities are found while the code is written instead of shortly before release. This article explains tools such as SAST and SCA and describes why security at runtime nevertheless remains indispensable.

SIEM

A SIEM collects log data from across the entire IT, links individual events into patterns and alerts on signs of attacks. This article explains how it works, the maintenance effort behind good detection rules, and the distinction from SOAR and XDR.

Social Engineering

Social engineering attacks people instead of technology: attackers gain trust, create pressure and get employees to release access or payments. This article shows the most important manipulation techniques, explains why they work, and describes protective measures built from processes and technology.

Software-Defined Networking (SDN)

Software-Defined Networking (SDN) separates the control of a network from the hardware that transports the data packets. Administrators define the behavior of the entire network centrally in software instead of configuring each device individually, which makes the network faster to adapt and more consistent.

Supply Chain Attack

In a supply chain attack, attackers compromise a supplier, a software update, or a component and use it to reach the systems of their actual targets. This article explains attack paths through software and service provider supply chains, the role of SBOMs, and the supply chain obligations arising from NIS-2.

T

Threat Intelligence

Threat intelligence is processed knowledge about attackers, their tools, and their infrastructure. Used correctly, it turns raw threat data into a basis for decisions: from prioritizing vulnerabilities to automatically blocking known attack infrastructure during live operations.

TLS/SSL

TLS is the standard protocol for encrypted connections on the internet and the technical successor to the historical SSL. This article explains how the handshake works, what role certificates play, when mTLS makes sense, and how transport encryption differs from a VPN.

V

Virtual Desktop Infrastructure (VDI)

Virtual Desktop Infrastructure (VDI) provides workplace desktops centrally in the data center, and users access them from almost any end device without the data leaving the central environment. This article explains how a VDI environment is built, along with its security advantages and limits, and draws the distinction from Desktop as a Service.

Visibility

Visibility refers to the continuously up-to-date view of the assets, communication relationships, and data flows of your own IT. Every effective security measure depends on this foundation: anyone who does not know which systems talk to one another can neither segment nor detect attacks.

VLAN

VLANs divide a physical network into logically separated segments at Layer 2, for example for guests, telephony, or production. This article explains tagging according to IEEE 802.1Q, typical use cases, and the limits of the technology when it comes to real security zones at the workload level.

VPN

A VPN builds an encrypted tunnel through public networks and thereby connects sites or individual devices to the company network. This article explains how it works, its forms of use, and the limits of the model when employees access distributed applications from anywhere.

Vulnerability Management

Vulnerability management detects security gaps in IT systems and ensures they are fixed before attackers exploit them. This article shows how the cycle of scanning, prioritizing and patching works, what role reachability and context play in the assessment, and where the difference to a penetration test lies.

Z

Zero Trust

Zero Trust is a security model that does not automatically trust any user, device, or service, regardless of whether the access comes from the corporate network or from outside. Every access is checked individually, strictly authenticated, and limited to the privileges required for the task.

Zero Trust Network Access (ZTNA)

Zero Trust Network Access (ZTNA) grants access to enterprise applications on the principle of check first, then connect. Instead of opening the entire network like a VPN, ZTNA connects each user specifically to individual applications after verifying identity, device, and context.

Zero-Day

A zero-day vulnerability is a security flaw for which no patch yet exists, because the vendor is unaware of it. Attackers exploit precisely this window, and traditional patch management inevitably comes up empty during this phase.

A term missing, or want to put a topic into practice in your own network? Talk to KAEMI.