Glossary Cybersecurity and networking, clearly explained

From Zero Trust to SDN: this glossary explains the terms that come up in every security and networking project — what each one means, how the technology works and what matters in practice.

#

3-2-1 backup rule

Three copies, two media types, one off-site: the 3-2-1 rule is the classic of data protection — today often as 3-2-1-1-0.

A

AI inference & GPU computing

Inference is the productive operation of AI models — and GPUs the infrastructure behind it. Where it runs decides cost and privacy.

Air gap

An air gap separates systems physically or logically from the network — the hardest isolation for backups and critical environments.

API security

API security protects interfaces against abuse: discovery against shadow APIs, schema validation, authentication and limits.

Application Dependency Mapping

Application Dependency Mapping automatically captures which applications and systems actually communicate with one another and presents these relationships as a map. This article explains how it works and shows why reliable communication maps form the foundation of every microsegmentation and migration plan.

Attack Surface

The attack surface comprises every point through which attackers can reach a company's IT systems, data and processes. Knowing it fully and reducing it systematically lowers the likelihood of successful attacks while limiting the damage they can cause.

B

BCM & contingency planning

Business continuity management keeps the business running in an emergency — with contingency plans NIS2 now demands.

BGP (Border Gateway Protocol)

The Border Gateway Protocol connects the internet's autonomous systems into a global network. This article explains how BGP selects routes, which risks such as route hijacking exist and why network operators with their own infrastructure have more control over their paths.

Bot management

Bot management separates wanted from malicious bots — using behavioural analysis instead of rigid IP and user-agent lists.

Botnet

A botnet is a collection of hijacked devices that attackers control remotely from a central point, without the owners knowing. Criminals use the pooled computing power for DDoS attacks, spam campaigns and cryptomining, among other things, often as a bookable service.

Breach Containment

Breach containment refers to the ability to confine a successful attack to a small part of the network. Instead of relying on prevention alone, the approach follows the assume-breach principle: compromises happen, and what matters is how far they can spread.

Brute force attack

Brute force tries passwords systematically — from simple wordlists to distributed guessing against thousands of accounts.

BSI C5

BSI C5 is the criteria catalogue for cloud security published by the German Federal Office for Information Security (BSI). With a C5 attestation, cloud providers demonstrate, after an independent audit, that their services meet a defined level of security.

BYOD (bring your own device)

Private devices for work: BYOD saves hardware but needs clear separation of data, access and responsibility.

C

CDN (Content Delivery Network)

A content delivery network serves web content via edge servers distributed around the world and thereby noticeably shortens load times. This article explains how caching and anycast work, what protective effect a CDN offers and where its limits lie.

CI/CD Security

CI/CD pipelines build and deliver software automatically, which makes them a target in their own right: whoever controls the pipeline controls the software. This article shows how to secure secrets, dependencies and artefacts, and why segmenting the build environment is part of it.

Cloud Detection and Response (CDR)

Cloud Detection and Response (CDR) detects ongoing attacks in cloud environments on the basis of telemetry from the control plane, identities and data flows. This article explains how it works and its typical scenarios, distinguishes CDR from EDR and shows how detection and containment work together.

Cloud Migration

Cloud migration refers to the planned relocation of applications and data into cloud environments. This article explains the 6R strategies, examines network and security aspects such as private connectivity and shows when lift-and-shift is worthwhile and when modernisation is the better choice.

Cloud on-ramp (Direct Connect & co.)

Cloud on-ramps are private entrances to AWS, Azure and co. — predictable performance and costs instead of the public internet.

Cloud Security

Cloud security covers all measures that protect data, applications and infrastructure in cloud environments against attacks and misconfigurations. This article explains the shared responsibility model, shows the key protection layers and describes how companies can use the cloud securely and in line with regulations.

Cloud Workload Protection (CWPP)

Cloud Workload Protection Platforms (CWPP) protect virtual machines, containers and serverless functions across their entire lifecycle. This article explains how they work and where they are used, shows the difference from CSPM and describes why visibility and segmentation form the core of effective workload protection.

Colocation

Colocation means: your own hardware in someone else’s data center — with professional infrastructure and direct cloud onramps.

Common Criteria

Common Criteria is the international standard for evaluating and certifying the security properties of IT products. This article explains protection profiles and the evaluation assurance levels EAL1 through EAL7, describes the role of the BSI and shows how this product standard differs from ISO 27001.

Conditional access

Conditional access decides per login based on context: who, from which device, from where, at what risk?

Container Orchestration

Container orchestration automates the distribution, scaling and self-healing of containerized applications across many servers. This article explains the core functions, the role of Kubernetes as the de facto standard, typical use cases and the distinction between the orchestrator and the container runtime.

Container Security

Container security protects applications from the image build through the registry to runtime. This article explains scanning, signatures, minimal privileges and isolation, shows typical use cases and compares the security model of containers with that of virtual machines.

Credential stuffing

Credential stuffing tests leaked passwords against your logins automatically — hitting wherever passwords are reused.

Cryptojacking

Cryptojacking steals compute for crypto mining: no encryption, no alarm — just silent costs.

CVE and CVSS

CVE uniquely names known vulnerabilities, while CVSS rates their severity on a scale from 0 to 10. This article explains how the two systems work together, which metrics lie behind the score and why the CVSS value alone does not yet determine patch priority.

Cyber kill chain

The cyber kill chain breaks attacks into phases — and shows that defenders can interrupt at every stage.

Cyber Resilience

Cyber resilience describes a company's ability to remain operational under attack and to recover quickly after disruptions. The approach combines prevention with containment and recovery, and thereby places the question of how operations survive an incident at the center.

Cyber Resilience Act (CRA)

The CRA makes cybersecurity a product duty: manufacturers of digital products are accountable for security across the lifecycle.

Cyberattack

A cyberattack is a targeted attempt to gain unauthorized access to IT systems and cause damage there. Most attacks follow a recurring sequence that defenders can interrupt at several points if they know it.

Cybersecurity

Cybersecurity refers to all technical and organizational measures to protect IT systems and data against attacks and misuse. At its center are the protection goals of confidentiality, integrity and availability, implemented through disciplines ranging from network security to identity protection.

Cybersecurity Compliance

Cybersecurity compliance refers to the demonstrable adherence to legal and contractual security requirements, from the GDPR through NIS2 and DORA to ISO 27001. This article classifies the most important frameworks, describes evidence and audits and explains why compliance and actual security are two different goals.

D

DDoS Attack

A DDoS attack floods servers, websites or entire networks with massive volumes of requests until regular users can no longer gain access. Read how these attacks work, which variants exist and how you can secure the availability of your services.

Deepfake & vishing

Cloned voices and fake videos make fraud credible: the call from the boss is no longer proof — processes must carry the weight.

DevSecOps

DevSecOps embeds security directly into the development cycle: as a shared responsibility of development, operations, and security, driven by automation. This article explains how the approach works, how it differs from DevOps, and what role the underlying infrastructure plays.

Disaster recovery (DR)

Disaster recovery is the planned way back into operation: strategies, sequences and rehearsed procedures for the IT emergency.

DLP (Data Loss Prevention)

Data loss prevention detects sensitive data and stops it from leaking — across web, email and SaaS as well as on the endpoint.

DNS Security

The Domain Name System governs practically every connection on the internet, yet it was designed without security mechanisms. This article shows how attacks such as cache poisoning and DNS tunneling work and how DNSSEC and Protective DNS guard against them.

DORA (Digital Operational Resilience Act)

DORA is the EU regulation for digital operational resilience in the financial sector, binding since January 2025. It obliges financial entities and their ICT service providers to maintain resilient risk management, incident reporting, resilience testing, and managed third-party risk.

Double extortion

Steal first, then encrypt: double extortion blackmails twice — a backup alone no longer saves you.

E

Edge computing

Edge computing processes data close to where it originates — for latencies central clouds cannot deliver.

Egress Costs

Egress costs are fees that cloud providers charge for outbound data traffic, and they rank among the hardest items of the cloud bill to plan for. This article explains how they arise, which architectures drive them, and which levers companies can use to reduce them.

Endpoint Detection and Response (EDR)

Endpoint Detection and Response (EDR) continuously records activity on endpoints, detects suspicious sequences within it, and enables fast countermeasures such as isolating affected systems during an incident. This article explains how EDR works and distinguishes the technology from classic antivirus and from XDR.

Endpoint Security

Endpoint security protects notebooks, servers, smartphones, and other devices against malware and unauthorized access. This article explains the evolution from classic antivirus to EPP and EDR, the role of hardening and patch management, and how endpoint security and network security complement each other.

EU AI Act

The EU AI Act regulates AI by risk: from prohibited practices via high-risk duties to transparency rules.

F

Firewall

The firewall controls data traffic between networks and blocks unwanted connections according to clear rules. Learn which firewall types exist, what modern systems can do, and why protection at the network edge today must be complemented by Zero Trust concepts.

Frontier AI

Frontier AI refers to the most capable generation of large AI models at the edge of what is technically feasible. For IT security, these models are tool and risk at once, because defenders and attackers draw on the same capabilities.

FWaaS (Firewall as a Service)

FWaaS moves the firewall into the cloud: one central policy for all sites and users instead of appliance sprawl.

G

GitOps

GitOps makes Git the single source of truth for infrastructure and applications: the target state resides versioned in the repository, and agents continuously reconcile it with reality. This article explains the pull principle together with its audit advantages and the difference from classic CI/CD deployment.

GPT-5.4-Cyber (ChatGPT Cyber)

GPT-5.4-Cyber is OpenAI's AI model specialised in cybersecurity, colloquially often called ChatGPT Cyber. It supports vulnerability discovery, code analysis and incident response and is available to defenders through a controlled access programme.

H

Hardening & CIS benchmarks

Hardening removes attack surface from systems; CIS benchmarks provide the vetted specifications — setting by setting.

Honeypot & deception

Honeypots are lures for attackers: systems without a legitimate purpose — any access is suspicious by definition.

Hybrid & multi-cloud

Hybrid combines own infrastructure with cloud, multi-cloud several providers — both need one thing above all: good networking.

Hypervisor

A hypervisor runs several virtual machines in isolation on shared hardware and forms the foundation of server virtualization, private clouds, VDI, and many cloud services. This article explains type 1 and type 2 hypervisors, central security questions from isolation to hypervisor-based segmentation, and the distinction from container runtimes.

I

IaaS, PaaS & SaaS

The three cloud service models differ in who operates what — and where responsibility, cost and control sit.

Identity provider (IdP)

The IdP is the central login authority: it verifies identities and issues signed tickets for all applications.

Immutable backup

Immutable backups can neither be deleted nor encrypted for a defined period — the insurance against ransomware.

Incident Response

Incident response refers to the structured process by which companies detect security incidents and resolve them in a controlled manner. A well-practiced procedure with clear roles and proven playbooks decides whether an incident stays a footnote or paralyzes operations for weeks.

Infrastructure as Code (IaC)

Infrastructure as Code describes servers, networks, and cloud resources in versioned configuration files from which environments are created automatically. This article explains declarative and imperative approaches, dealing with drift, and security scans for templates, including how it differs from configuration management.

Insider threat

The danger from within: legitimate access, abused or used negligently — invisible at the perimeter.

IoC (Indicators of Compromise)

IoCs are traces of an attack: hashes, domains, IP addresses. Valuable for hunting — but quickly outdated.

ISO 27001

ISO 27001 is the leading international standard for information security management systems (ISMS). Companies get certified against it to demonstrate verifiably to customers, partners, and regulators that information security is managed systematically.

IT-Grundschutz (BSI)

BSI IT-Grundschutz translates information security into concrete modules and requirements — Germany’s standard reference.

K

Kubernetes Security

Kubernetes security covers all layers of a cluster: images, pods, network policies, RBAC, and secrets. This article explains how the protective layers interlock, why default values rarely suffice, and where microsegmentation goes beyond what NetworkPolicies can do.

L

Latency and Jitter

Latency describes the travel time of data packets in the network, jitter their variation. This article explains how both quantities arise, why VoIP and video are especially sensitive, and which measures let companies noticeably improve response times.

Lateral Movement

Lateral movement refers to techniques with which attackers work their way from system to system through a network after the initial breach. The goal is to expand privileges, find sensitive data, and ultimately bring critical systems under control.

Least privilege

Least privilege means: every identity gets only the rights it really needs — and only for as long as necessary.

LLM (large language model)

Large language models process and generate language — the base technology behind ChatGPT, copilots and enterprise AI.

M

Malware

Malware is the umbrella term for software that deliberately causes harm: from data theft to the encryption of entire systems. The main types differ in their distribution path and goal, with direct consequences for the appropriate defense strategy.

Man-in-the-middle attack (MitM)

In a MitM attack the attacker sits unnoticed between two parties — reading along or manipulating the communication.

MDM & UEM

MDM manages mobile devices, UEM all endpoints from one console — and supplies device state for Zero Trust decisions.

Microsegmentation

Microsegmentation divides networks into the smallest zones and controls the data traffic between individual workloads, independently of IP addresses and VLANs. The approach stops lateral movement by attackers and is regarded as a core building block of every Zero Trust architecture.

MITRE ATT&CK

MITRE ATT&CK is the catalogue of real attacker tactics and techniques — the shared language for detection and defence.

MPLS

MPLS forwards data packets based on labels over fixed paths and was for years the standard for connecting company sites. This article explains how the technology works and its strengths, shows its limits in the cloud era, and clarifies when SD-WAN is the better choice.

MTTR (Mean Time to Repair)

MTTR measures how quickly a service runs again after an incident — the metric that decides real downtime costs.

Multi-Factor Authentication (MFA)

Multi-factor authentication combines at least two independent proofs from knowledge, possession, and biometrics, and thereby renders stolen passwords largely worthless. This article explains methods from TOTP to passkeys, their phishing resistance, and how they differ from 2FA.

Mythos (Claude Mythos)

Mythos is Anthropic's most powerful AI model, with autonomous offensive security capabilities that mark a turning point: vulnerability discovery, exploit development, and attack chains run at large scale for the first time without human involvement. The term therefore stands in for a new threat landscape.

N

Network Access Control (NAC)

Network Access Control (NAC) decides at the access point which users and devices are allowed to connect to the enterprise network. This article explains authentication via 802.1X and the assessment of device state, and shows how guest and BYOD access are cleanly separated and how NAC differs from ZTNA.

Network as a Service (NaaS)

With Network as a Service, a provider designs, delivers and operates the corporate network as an ongoing service — predictable costs, binding SLAs and 24/7 operations instead of own hardware and staffing.

Network Security

Network security protects a company's communication paths, from the internet connection through the internal network to the individual application. This article explains the key protective layers, shows typical deployment scenarios, and puts into context how modern concepts such as Zero Trust help.

Network Segmentation

Network segmentation divides a company network into separate areas, each with its own access rules and security levels. Incidents, disruptions, and unauthorized access are thus confined to individual zones instead of spreading unchecked across a company's entire network.

NIS-2

NIS-2 is the EU directive for network and information security that obliges considerably more companies to adopt cybersecurity measures and reporting duties than its predecessor. It makes cybersecurity a demonstrable duty of executive management.

NOC (Network Operations Center)

The NOC monitors and operates networks around the clock: detecting, fixing and escalating faults — before users notice.

O

Observability

Observability refers to the ability to infer the internal state of IT systems from their outputs, above all from logs, metrics, and traces. This article explains these data types and the difference from traditional monitoring, and shows why observability is gaining importance for network operations and security analysis.

OT Security

OT security protects control and production systems in which availability takes priority, life cycles span decades, and patching is often barely possible. This article explains the differences from IT security, the Purdue model, and why segmentation is the central protective measure for production networks.

OWASP

OWASP is a non-profit organization that provides freely available standards, tools, and knowledge around application security. Best known are the OWASP Top 10, the list of the most critical risks for web applications.

P

Passkeys & FIDO2

Passkeys replace passwords with cryptography: phishing-resistant, no secrets on servers — the new login standard.

Patch management

Patch management closes vulnerabilities before attackers exploit them — prioritised, tested and demonstrable.

PCI DSS

PCI DSS is the credit card industry's security standard for all companies that store, process, or transmit cardholder data. This article explains the core requirements, shows how network segmentation considerably reduces the audit scope, and distinguishes the standard from the GDPR.

Peering and Interconnection

Peering refers to the direct exchange of data traffic between two networks without a detour via transit providers. This article explains the difference between public peering at internet exchanges and private interconnects and shows why direct paths lower latency and costs and increase control over the data path.

Penetration Testing

A penetration test is a commissioned, controlled attack on one's own IT that uncovers exploitable vulnerabilities before real attackers find them. This article explains the goals, test types, and process, clarifies the legal basis, and distinguishes the pentest from the automated vulnerability scan.

Personal Data (PII)

Personal data is all information that can be assigned to an identified or identifiable person. This article explains the GDPR definition, the special categories, suitable technical and organizational protective measures, and the difference between PII and pseudonymized data.

Phishing

Phishing is the attempt to obtain credentials, money, or confidential information via forged messages. This article shows how such attacks proceed, which variants exist from spear phishing to business email compromise, and with which measures companies effectively limit the damage.

Post-Quantum Cryptography (PQC)

Post-quantum cryptography covers encryption and signature methods that withstand attacks from quantum computers as well. Because data intercepted today can be decrypted later, migration does not begin with the first quantum computer but now.

Prompt injection

Prompt injection smuggles instructions into AI systems — the most important new attack class for LLM applications.

R

Ransomware

Ransomware encrypts data and systems to extort a ransom, paralyzing entire companies in the process. This article explains how such attacks unfold, why backups alone save no one, and which measures let you limit damage effectively.

Ransomware-as-a-Service (RaaS)

RaaS turns extortion into a franchise: developers supply the software, affiliates break in — proceeds are shared.

Remote Browser Isolation (RBI)

Browser isolation runs websites in the cloud instead of on the device — malicious code stays out, phishing comes to nothing.

Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) grants permissions through roles instead of individual rights per person. This keeps access control auditable even in large environments, and it lets you enforce least privilege in everyday operation, from the cloud platform to the network policy.

RTO & RPO

RTO says how fast a system must run again; RPO how much data loss is bearable — the two levers of any DR planning.

S

SASE/SSE

SASE/SSE shifts network and security functions into a shared cloud platform that serves users and sites at the nearest access point. Building blocks such as ZTNA, Secure Web Gateway, CASB and Firewall as a Service replace the central appliance in the data center.

SD-WAN (Software-Defined WAN)

SD-WAN controls site connectivity in software: traffic automatically takes the best path over internet, fibre or mobile — centrally managed, encrypted and more flexible than rigid MPLS lines.

Security Breach

A security breach occurs when protective measures have actually been broken through and unauthorized parties have gained access to systems or data. The term is narrower than that of an incident and triggers concrete obligations, from the GDPR report within 72 hours to informing those affected.

Security Operations Center (SOC)

A security operations center continuously monitors the IT environment, assesses alerts and responds to incidents before anomalies turn into larger damage. This article explains tasks, roles and tools as well as the decision between an internal and a managed SOC.

Security Policy

A security policy defines in a binding way how a company handles information, systems and access. It ranges from the management directive to the technical segmentation rule and takes effect only when both levels fit together and are enforced.

Shadow IT & shadow AI

Tools nobody approved: shadow IT and shadow AI process company data outside any control.

Shift-Left Security

Shift-left security moves security checks to the start of software development: vulnerabilities are found while the code is written instead of shortly before release. This article explains tools such as SAST and SCA and describes why security at runtime nevertheless remains indispensable.

SIEM

A SIEM collects log data from across the entire IT, links individual events into patterns and alerts on signs of attacks. This article explains how it works, the maintenance effort behind good detection rules, and the distinction from SOAR and XDR.

SLA (Service Level Agreement)

An SLA makes service quality measurable: availability, response times and consequences of missing them — contractually assured.

Social Engineering

Social engineering attacks people instead of technology: attackers gain trust, create pressure and get employees to release access or payments. This article shows the most important manipulation techniques, explains why they work, and describes protective measures built from processes and technology.

Software-Defined Networking (SDN)

Software-Defined Networking (SDN) separates the control of a network from the hardware that transports the data packets. Administrators define the behavior of the entire network centrally in software instead of configuring each device individually, which makes the network faster to adapt and more consistent.

SQL injection

SQL injection smuggles database commands through input fields — known for decades and still among the top risks.

SSO (Single Sign-on)

SSO: sign in once, use all applications — fewer passwords, central control, clean offboarding.

Supply Chain Attack

In a supply chain attack, attackers compromise a supplier, a software update, or a component and use it to reach the systems of their actual targets. This article explains attack paths through software and service provider supply chains, the role of SBOMs, and the supply chain obligations arising from NIS-2.

SWG (Secure Web Gateway)

A secure web gateway filters user web traffic: malware protection, URL filtering and policies — everywhere, not just in the office.

T

Threat Intelligence

Threat intelligence is processed knowledge about attackers, their tools, and their infrastructure. Used correctly, it turns raw threat data into a basis for decisions: from prioritizing vulnerabilities to automatically blocking known attack infrastructure during live operations.

TISAX

TISAX is the automotive industry’s information security assessment: one assessment, recognised by all participants.

TLS/SSL

TLS is the standard protocol for encrypted connections on the internet and the technical successor to the historical SSL. This article explains how the handshake works, what role certificates play, when mTLS makes sense, and how transport encryption differs from a VPN.

V

Virtual Desktop Infrastructure (VDI)

Virtual Desktop Infrastructure (VDI) provides workplace desktops centrally in the data center, and users access them from almost any end device without the data leaving the central environment. This article explains how a VDI environment is built, along with its security advantages and limits, and draws the distinction from Desktop as a Service.

Visibility

Visibility refers to the continuously up-to-date view of the assets, communication relationships, and data flows of your own IT. Every effective security measure depends on this foundation: anyone who does not know which systems talk to one another can neither segment nor detect attacks.

VLAN

VLANs divide a physical network into logically separated segments at Layer 2, for example for guests, telephony, or production. This article explains tagging according to IEEE 802.1Q, typical use cases, and the limits of the technology when it comes to real security zones at the workload level.

VPN

A VPN builds an encrypted tunnel through public networks and thereby connects sites or individual devices to the company network. This article explains how it works, its forms of use, and the limits of the model when employees access distributed applications from anywhere.

Vulnerability Management

Vulnerability management detects security gaps in IT systems and ensures they are fixed before attackers exploit them. This article shows how the cycle of scanning, prioritizing and patching works, what role reachability and context play in the assessment, and where the difference to a penetration test lies.

W

WAF (Web Application Firewall)

A WAF filters HTTP traffic before it reaches the application: it blocks attacks such as SQL injection and XSS at the edge.

Wi-Fi 6E and Wi-Fi 7

Wi-Fi 6E opens the 6 GHz band, Wi-Fi 7 adds wider channels and multi-link: more capacity and lower latency in corporate WLAN.

X

XSS (cross-site scripting)

XSS injects foreign JavaScript into your website — running in your users’ browsers, with their rights.

Z

Zero Trust

Zero Trust is a security model that does not automatically trust any user, device, or service, regardless of whether the access comes from the corporate network or from outside. Every access is checked individually, strictly authenticated, and limited to the privileges required for the task.

Zero Trust Network Access (ZTNA)

Zero Trust Network Access (ZTNA) grants access to enterprise applications on the principle of check first, then connect. Instead of opening the entire network like a VPN, ZTNA connects each user specifically to individual applications after verifying identity, device, and context.

Zero-Day

A zero-day vulnerability is a security flaw for which no patch yet exists, because the vendor is unaware of it. Attackers exploit precisely this window, and traditional patch management inevitably comes up empty during this phase.

A term missing, or want to put a topic into practice in your own network? Talk to KAEMI.