Cybersecurity Abbreviations
119 abbreviations · part of Technology & Computer Abbreviations
Abbreviations from information security: authentication (2FA, MFA, SSO), attack types (DDoS, XSS, SQLi), vulnerability tracking (CVE, CVSS), security operations tools (SIEM, EDR, SOC), cryptography (AES, RSA, TLS), access-control models, compliance frameworks and professional certifications. Security vendors coin new acronyms frequently, so entries explain how similar-sounding categories such as EDR, XDR and MDR differ.
| Abbreviation | Stands for | Description |
|---|---|---|
| 2FA | Two-factor authentication | A login method that requires two different kinds of proof of identity, typically something you know (a password) plus something you have (a phone or security key) or… |
| AAA | Authentication, authorization and accounting | A security framework for network access that verifies who a user is, decides what they may do, and records what they did for auditing or billing. |
| ABAC | Attribute-based access control | An access model that decides each request by evaluating attributes of the user, resource, action and environment against policies, for example letting doctors view… |
| ACL | Access control list | A list attached to a resource, such as a file, folder, network interface or storage bucket, that specifies which users, groups or traffic are allowed or denied and with… |
| AES | Advanced Encryption Standard | The symmetric block cipher used worldwide to encrypt data at rest and in transit, from Wi-Fi and HTTPS to disk encryption and messaging apps. |
| APT | Advanced persistent threat | A sophisticated, well-resourced attacker, typically state-sponsored, that gains long-term covert access to a target network to steal data or prepare sabotage. |
| ASLR | Address space layout randomization | A defense built into operating systems that places a program's code, libraries, stack and heap at random memory addresses each time it runs, so attackers exploiting… |
| ATT&CK | Adversarial Tactics, Techniques, and Common Knowledge | A free knowledge base from MITRE that catalogs attacker behavior observed in real intrusions, organized into tactics such as initial access and persistence and hundreds… |
| AV | Antivirus | Software that detects, blocks and removes malware on computers and phones, using signatures of known threats along with behavior monitoring and cloud reputation checks. |
| BEC | Business email compromise | Fraud in which criminals impersonate executives, suppliers or partners by email, often from a hacked or look-alike account, to trick employees into wiring money or… |
| BYOD | Bring your own device | Workplace policy that lets employees use personal phones, tablets or laptops for work email, apps and data. |
| C2 | Command and control | Exercise of authority and direction by a commander over assigned forces, and the people, procedures, communications and facilities used to plan, direct and coordinate… |
| CA | Certificate authority | An organization or system that verifies identities and issues digital certificates, such as the TLS certificates websites use for HTTPS. |
| CAPTCHA | Completely Automated Public Turing test to tell Computers and Humans Apart | A challenge websites use to block bots, such as typing distorted letters, picking images that show traffic lights or ticking a box while the site analyzes behavior. |
| CASB | Cloud access security broker | Security software that sits between users and cloud services to enforce policies, discover unsanctioned "shadow IT" apps, prevent data leaks and detect risky behavior… |
| CEH | Certified Ethical Hacker | Certification from the EC-Council covering tools and techniques that attackers use, so security professionals can test and defend systems. |
| CERT | Computer Emergency Response Team | A team that coordinates responses to cybersecurity incidents and vulnerabilities for an organization, sector or country, issuing advisories and helping victims. |
| CIA | Confidentiality, integrity, availability | The three core goals of information security, known as the CIA triad: keeping data secret from unauthorized people, keeping it accurate and unaltered, and keeping… |
| CISO | Chief information security officer | The senior executive responsible for an organization's information and cybersecurity strategy, risk management, security operations and compliance, typically reporting… |
| CISSP | Certified Information Systems Security Professional | Advanced cybersecurity certification from ISC2 requiring five years of paid experience in at least two of its eight domains, such as security and risk management and… |
| CSPM | Cloud security posture management | Tools that continuously scan cloud accounts for misconfigurations and compliance violations, such as public storage buckets, overly permissive IAM roles or unencrypted… |
| CSR | Certificate signing request | A file generated alongside a new private key and sent to a certificate authority to apply for a certificate. |
| CSRF | Cross-site request forgery | An attack that tricks a logged-in user's browser into sending an unwanted request to a site where they are authenticated, such as changing their email address or… |
| CTF | Capture the flag | Objective-based game mode in which teams try to steal the enemy's flag from its base and return it to their own while defending their flag. |
| CVE | Common Vulnerabilities and Exposures | The public catalog that gives each disclosed security vulnerability a unique identifier, such as CVE-2021-44228 for Log4Shell, so vendors, researchers and tools can… |
| CVSS | Common Vulnerability Scoring System | An open framework for rating the severity of security vulnerabilities from 0 to 10, based on factors such as attack complexity, required privileges and impact on… |
| CWE | Common Weakness Enumeration | A community-developed list of software and hardware weakness types, such as CWE-79 for cross-site scripting and CWE-89 for SQL injection, used to classify the root… |
| DAC | Discretionary access control | Lets the owner of a file or resource decide who else may access it, as with ordinary Unix permissions and Windows file sharing. |
| DAST | Dynamic application security testing | Testing a running application from the outside by sending crafted requests, as an attacker would, to find vulnerabilities such as injection flaws, misconfigurations and… |
| DDoS | Distributed denial of service | An attack that overwhelms a website, server or network with traffic from many compromised machines at once, often a botnet of hijacked computers and IoT devices, so… |
| DES | Data Encryption Standard | A symmetric block cipher adopted as a US federal standard in 1977, using a 56-bit key that is now far too short to be secure. |
| DevSecOps | Development, security and operations | The practice of building security into every stage of the DevOps software lifecycle, automating checks such as code scanning, dependency analysis and infrastructure… |
| DFIR | Digital forensics and incident response | The combined discipline of investigating security incidents: collecting and analyzing evidence from disks, memory, logs and networks to establish what happened, then… |
| DH | Diffie-Hellman (key exchange) | A method that lets two parties agree on a shared secret key over a public channel without ever transmitting it, by each combining their own private value with the… |
| DKIM | DomainKeys Identified Mail | An email authentication method in which the sending server adds a cryptographic signature to message headers, verifiable with a public key published in the sender's… |
| DLP | Data loss prevention | Security tools and policies that detect and block sensitive data, such as card numbers, health records or source code, from leaving an organization through email… |
| DMARC | Domain-based Message Authentication, Reporting and Conformance | An email policy standard built on SPF and DKIM that lets a domain owner tell receivers what to do with mail failing authentication (none, quarantine or reject) and… |
| DoS | Denial of service | An attack that makes a system unavailable to its intended users, either by flooding it with traffic or by exploiting a flaw that crashes it or exhausts its resources. |
| DPI | Deep packet inspection | Examining the contents of network packets, not just their headers, to identify applications, detect threats, enforce policies or censor traffic. |
| DSA | Digital Signature Algorithm | A public-key digital signature standard proposed by the US National Institute of Standards and Technology in 1991 and based on discrete logarithms. |
| E2EE | End-to-end encryption | Encryption in which only the communicating users hold the keys, so messages are encrypted on the sender's device and decrypted only on the recipient's, and the service… |
| EAP | Extensible Authentication Protocol | A framework that carries many different authentication methods, such as certificates, passwords or SIM credentials, between a client, a network device and an… |
| ECC | Elliptic-curve cryptography | Public-key cryptography based on the algebra of elliptic curves, offering the same security as RSA with much smaller keys and faster operations. |
| ECDSA | Elliptic Curve Digital Signature Algorithm | A digital signature scheme built on elliptic-curve cryptography, used for TLS certificates, software updates and cryptocurrency transactions. |
| EDR | Endpoint detection and response | Security software installed on laptops, servers and other endpoints that continuously records activity, detects malicious behavior and lets responders investigate and… |
| FIDO | Fast Identity Online | A set of open authentication standards from the FIDO Alliance that replace passwords with public-key cryptography, using security keys, phone biometrics or built-in… |
| GPG | GNU Privacy Guard | A free, open-source implementation of the OpenPGP standard for encrypting and signing data and communications. |
| GRC | Governance, risk and compliance | Integrated approach that aligns corporate governance, risk management and regulatory compliance so they share data, controls and reporting. |
| HMAC | Hash-based message authentication code | A widely used way to build a message authentication code from a cryptographic hash function such as SHA-256 and a secret key. |
| HSM | Hardware security module | A tamper-resistant physical device that generates, stores and uses cryptographic keys so they never leave the hardware in readable form. |
| HSTS | HTTP Strict Transport Security | A response header that tells browsers to connect to a site only over HTTPS for a set period, automatically upgrading http links and refusing to let users click through… |
| IAM | Identity and access management | The policies, processes and technologies that control who can access which systems and data, covering accounts, authentication, roles, permissions and the… |
| IDS | Intrusion detection system | A system that monitors network traffic or host activity for signs of attacks or policy violations and raises alerts, without blocking traffic itself. |
| IoC | Indicator of compromise | A piece of forensic evidence suggesting a system has been breached, such as a malicious file hash, IP address, domain, registry key or unusual network pattern. |
| IPS | Intrusion prevention system | A security system placed inline with network traffic that detects attacks and actively blocks them, for example by dropping malicious packets or resetting connections. |
| IR | Incident response | The organized process of detecting, containing, investigating and recovering from security incidents such as ransomware or data breaches, guided by a written plan and a… |
| ISO 27001 | ISO/IEC 27001 (information security management standard) | The international standard specifying requirements for an information security management system (ISMS), under which an organization assesses risks and implements… |
| JWT | JSON Web Token | A compact, URL-safe token that carries signed JSON claims, such as a user ID and expiry time, in three base64url-encoded parts separated by dots. |
| KMS | Key Management Service | Microsoft volume-activation technology that lets organizations activate Windows and Office on their own network instead of contacting Microsoft for each machine. |
| MAC | Mandatory access control | An access model in which a central policy, not the owner of a resource, decides who can access it, typically by comparing security labels such as Secret or Top Secret… |
| MD5 | Message-Digest Algorithm 5 | A hash function that produces a 128-bit fingerprint, once used everywhere for checksums and password storage. |
| MDM | Mobile device management | Software that lets an organization enroll, configure, secure and remotely wipe smartphones, tablets and laptops, enforcing passcodes, encryption, Wi-Fi settings and app… |
| MDR | Managed detection and response | A service in which an outside provider's analysts monitor a customer's environment around the clock using EDR or XDR tools, investigate alerts and take response actions… |
| MFA | Multi-factor authentication | Authentication that requires two or more independent factors from different categories: knowledge (password, PIN), possession (phone, hardware key, smart card) and… |
| MITM | Man-in-the-middle | An attack in which someone secretly intercepts, and possibly alters, communication between two parties who believe they are talking directly. |
| MSSP | Managed security service provider | A company that monitors and manages security devices and services for other organizations, such as firewalls, intrusion detection, vulnerability scanning and log… |
| mTLS | Mutual TLS | A form of TLS in which both the client and the server present certificates and verify each other, rather than only the server proving its identity. |
| NAC | Network access control | Technology that checks devices and users before letting them onto a network, verifying identity and security posture, such as patch level or antivirus status, and… |
| NDR | Network detection and response | Security tools that analyze network traffic with behavioral models and machine learning to spot threats such as lateral movement, data exfiltration and… |
| NGFW | Next-generation firewall | A firewall that combines traditional port and address filtering with deeper inspection, including application awareness, user identity, intrusion prevention, TLS… |
| NTLM | NT LAN Manager | A family of Microsoft challenge-response authentication protocols used in Windows networks before and alongside Kerberos. |
| NVD | National Vulnerability Database | The US government database, run by NIST, that enriches CVE records with severity scores, affected product lists and references, feeding vulnerability scanners and patch… |
| OAuth | Open Authorization | An open standard that lets users grant an application limited access to their data on another service without sharing their password, using access tokens. "Sign in with… |
| OIDC | OpenID Connect | An identity layer built on OAuth 2.0 that lets applications verify who a user is and obtain basic profile information through a signed ID token, usually a JWT. |
| OSCP | Offensive Security Certified Professional | Hands-on penetration testing certification from OffSec, earned by hacking into a set of machines in a proctored exam lasting nearly 24 hours and then submitting a… |
| OSINT | Open-source intelligence | Intelligence derived from publicly available information, such as news reports, social media, commercial satellite images, flight trackers and public records. |
| OTP | One-time password | A password or numeric code valid for only one login or transaction, usually for a few minutes, sent by SMS or email or generated by an authenticator app or hardware… |
| OWASP | Open Worldwide Application Security Project | A nonprofit foundation that produces free resources for software security, best known for the OWASP Top 10 list of the most critical web application risks, plus testing… |
| PAM | Privileged access management | Security tools and practices for controlling and monitoring accounts with elevated rights, such as domain administrators, root accounts and service accounts, through… |
| PCI DSS | Payment Card Industry Data Security Standard | The security standard every organization that stores, processes or transmits payment card data must follow, covering network security, encryption, access control… |
| PFS | Perfect forward secrecy | A property of key-exchange protocols in which each session uses fresh temporary keys, so stealing a server's long-term private key later does not allow recorded past… |
| PGP | Pretty Good Privacy | An encryption program and standard for signing and encrypting email and files with public-key cryptography, built around a decentralized "web of trust" rather than… |
| PII | Personally identifiable information | Any information that can identify a specific person, alone or combined with other data, such as names, Social Security numbers, email addresses, phone numbers, IP… |
| PKI | Public key infrastructure | The system of certificate authorities, digital certificates, policies and software that binds public keys to identities, letting strangers communicate securely. |
| PUP | Potentially unwanted program | Software that is not clearly malware but behaves in ways users usually do not want, such as adware, browser toolbars, search hijackers and bundled "optimizers"… |
| RaaS | Ransomware as a service | A criminal business model in which ransomware developers rent their malware and payment infrastructure to affiliates, who carry out attacks and share the ransom with… |
| RADIUS | Remote Authentication Dial-In User Service | A networking protocol that centralizes authentication, authorization and accounting for users connecting to a network, used by enterprise Wi-Fi, VPN gateways and… |
| RAT | Remote access trojan | Malware that gives an attacker hidden remote control of an infected computer, including file access, keylogging, screen capture and webcam or microphone activation. |
| RBAC | Role-based access control | An access model that grants permissions to roles, such as "editor" or "billing admin", and assigns users to roles, rather than giving rights to each user individually. |
| RCE | Remote code execution | A vulnerability class that lets an attacker run arbitrary code on a target machine over a network, often without any login. |
| RSA | Rivest-Shamir-Adleman | A public-key cryptosystem used for encryption, digital signatures and key exchange, whose security rests on the difficulty of factoring the product of two large prime… |
| SAML | Security Assertion Markup Language | An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider, widely used for enterprise single… |
| SASE | Secure access service edge | A cloud-delivered architecture that combines networking (SD-WAN) with security services, such as secure web gateways, CASB, ZTNA and firewall as a service, so users get… |
| SAST | Static application security testing | Analyzing source code, bytecode or binaries for security flaws without running the program, finding issues such as injection, hard-coded secrets and unsafe functions… |
| SBOM | Software bill of materials | A machine-readable inventory of all components, libraries and versions that make up a piece of software, like an ingredients list. |
| SCA | Software composition analysis | Tools that inventory the open-source libraries and dependencies in an application and flag known vulnerabilities, outdated versions and license conflicts. |
| SHA | Secure Hash Algorithm | A family of cryptographic hash functions published by NIST that turn any input into a fixed-length fingerprint. |
| SHA-256 | Secure Hash Algorithm 256-bit | A member of the SHA-2 family that produces a 256-bit hash, usually written as 64 hexadecimal characters. |
| SIEM | Security information and event management | A platform that collects logs and security events from servers, network devices, cloud services and applications, correlates them and raises alerts on suspicious… |
| SOAR | Security orchestration, automation and response | Platforms that automate security operations workflows, such as enriching alerts, isolating infected hosts or blocking malicious domains, through playbooks that connect… |
| SOC | Security operations center | A team, and often a dedicated facility, that monitors an organization's systems around the clock to detect, investigate and respond to cyber threats, using tools such… |
| SOC 2 | System and Organization Controls 2 | An AICPA attestation report in which an independent auditor evaluates a service provider's controls against the Trust Services Criteria: security, plus optionally… |
| SPF | Sender Policy Framework | An email authentication method in which a domain publishes a DNS TXT record listing the servers allowed to send mail on its behalf, so receiving servers can reject… |
| SQLi | SQL injection | An attack in which input supplied to an application is interpreted as part of a database query, letting an attacker read, change or delete data, bypass logins or… |
| SSL | Secure Sockets Layer | The original protocol for encrypting connections between browsers and web servers, created by Netscape in the mid-1990s and replaced by TLS. "SSL" survives as everyday… |
| SSO | Single sign-on | An authentication setup that lets a user log in once with one set of credentials and then reach many separate applications without signing in again. |
| SSRF | Server-side request forgery | A vulnerability in which an attacker makes a server send requests to destinations of the attacker's choosing, often internal systems or cloud metadata services that are… |
| TLS | Transport Layer Security | The cryptographic protocol that encrypts and authenticates data sent over networks, protecting HTTPS websites, email, VPNs and APIs. |
| Tor | The Onion Router | Free software and a volunteer-run network that anonymizes internet traffic by routing it through three randomly chosen relays with layered encryption, so no single… |
| TOTP | Time-based one-time password | An algorithm that generates short-lived codes, usually six digits changing every 30 seconds, from a shared secret and the current time. |
| TPM | Trusted Platform Module | Security chip, or firmware equivalent, that stores encryption keys, certificates and boot measurements in hardware that resists tampering. |
| TTP | Tactics, techniques and procedures | The patterns of behavior that characterize a threat actor: its goals (tactics), the methods it uses to reach them (techniques) and its specific implementation details… |
| UTM | Unified threat management | An all-in-one security appliance combining a firewall with intrusion prevention, antivirus, web filtering, VPN and spam filtering, aimed mainly at small and mid-sized… |
| WAF | Web application firewall | A firewall that inspects HTTP traffic to and from web applications, blocking attacks such as SQL injection, cross-site scripting and malicious bots. |
| WebAuthn | Web Authentication | A W3C browser API that lets websites register and authenticate users with public-key credentials stored in security keys, phones or laptops instead of passwords. |
| X.509 | X.509 (public key certificate standard) | The standard format for public key certificates, defining fields such as subject, issuer, validity period, public key and extensions like subject alternative names. |
| XDR | Extended detection and response | A security approach that correlates detection data across endpoints, email, identity, network and cloud in one platform instead of treating each tool's alerts separately. |
| XSS | Cross-site scripting | A web vulnerability in which an attacker gets a site to include malicious JavaScript in pages viewed by other users, letting the script steal session cookies, capture… |
| ZTNA | Zero trust network access | An approach to remote access that grants users access only to specific applications after verifying identity, device health and context for each session, instead of… |
More technology & computer abbreviations
- Artificial Intelligence Abbreviations (103)
- Cloud Computing Abbreviations (63)
- Computer Abbreviations (92)
- Computer Hardware Abbreviations (151)
- Consumer Electronics Abbreviations (104)
- Cryptocurrency & Blockchain Abbreviations (74)
- Data & Database Abbreviations (53)
- File Format Abbreviations (125)
- Internet & Web Abbreviations (76)
- Networking Abbreviations (113)
- Programming Abbreviations (154)
- Software Abbreviations (70)
- Telecom Abbreviations (114)