CyberDex

Security language, translated for humans.

Plain-language definitions for cybersecurity, cryptography, hacking acronyms, and well-known APT groups—curated by the team building Secretus.

Search the index

190 of 190 entries shown

Category

Core concepts

The foundational ideas the rest of security builds on.

Air gap: Physically isolating a system from untrusted networks so data can only cross by deliberate human action. It raises the cost of remote attack substantially but does not eliminate it: removable media, supply chain compromise and insiders all cross air gaps, as several well-documented incidents show.
Attack surface: The total set of points where an attacker could try to enter or extract data from a system. Reducing it — fewer servers, less stored data, shorter retention — is one of the most reliable defenses.
Attestation: A signed statement about a subject that a relying party can verify — that a binary was built from a given source, that a device booted unmodified firmware, or that a key lives in specific hardware. Its value depends entirely on what the signer actually checked before signing.
Authentication— AuthN: Proving that a user, device, or service is who it claims to be. Passwords, passkeys, security keys, and one-time codes are authentication factors; authentication answers 'who are you?', not 'what may you do?'.
Authorization— AuthZ: Deciding what an authenticated identity is allowed to read, change, or execute. A system can authenticate someone correctly and still be vulnerable if its authorization checks are missing or inconsistent.
Build provenance— Provenance attestation: Cryptographic evidence linking a published artifact to the source commit and pipeline that produced it. It proves the package really was built by the workflow it names — but not that the commit was written by someone who should have been writing it, so a compromised maintainer account can publish malicious code with perfectly valid provenance.
CIA triad— confidentiality, integrity, availability: A basic security model: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized or undetected change, and availability keeps systems and data accessible when needed.
Client-side encryption— browser-side encryption: Encrypting data on the user's device before it is uploaded or transmitted. It limits what an intermediary can read, provided the client code, device, key handling, and delivery path are also trustworthy.In Secretus: Secretus encrypts and decrypts secret content in the browser; the servers do not receive plaintext secrets or decryption keys.
Data minimization: Collecting, processing, and retaining only the data needed for a defined purpose. Less data means less material to expose, misuse, subpoena, or recover after a breach.
Data retention: The rules and time periods governing how long data is kept before deletion or anonymization. Retention should reflect operational, legal, and security needs rather than defaulting to permanent storage.
Defense in depth: Layering multiple independent controls so that no single failure is catastrophic. If one layer is bypassed, another still stands.
End-to-end encryption— E2EE: Encryption where only the communicating endpoints hold the keys, so no server, network provider, or platform in between can read the content. Data is encrypted before it leaves the sender's device and decrypted only after it reaches the recipient's.In Secretus: Secretus encrypts and decrypts payloads in the browser. During normal operation, shipped secret endpoints receive ciphertext rather than plaintext and do not receive URL-fragment or private decryption material; compromised clients or delivered code remain outside this boundary.
Ephemeral: Existing only briefly, then gone. An ephemeral message or key is designed to disappear after use rather than persist — the opposite of email and chat, which retain everything by default.
Forward secrecy— PFS — perfect forward secrecy: A property where compromising a long-term key does not expose past sessions, because each session uses fresh, ephemeral keys that are discarded afterward. Recording today's traffic and stealing the key tomorrow still doesn't decrypt it.
Install script— Lifecycle hook, preinstall/postinstall: A command a package declares to run automatically during installation. It is a legitimate mechanism for compiling native bindings, and also the point at which a dependency executes arbitrary code with your credentials, on every developer machine and CI runner, before any test or lint runs. Keeping an inventory of which dependencies use one — and reviewing every addition — is a cheap, durable control.
Key exchange— key agreement: The process by which two parties who have never met establish a shared secret key over an untrusted channel, without ever transmitting the key itself. The security of an encrypted channel usually hinges here.
Least privilege— PoLP — principle of least privilege: Giving each user, service, and process only the permissions needed for its current task, for no longer than needed. This limits the blast radius of mistakes and compromised accounts.
Lockfile: A file recording the exact version and integrity hash of every dependency actually installed, including transitive ones. Committing it and installing from it — npm ci rather than npm install — is what makes a build reproducible and stops a fresh malicious release from being pulled in silently.
Metadata: Data about data: who talked to whom, when, how often, and how big the message was — even when the content itself is encrypted. Metadata frequently reveals more than people expect.
One-time secret— burn-after-reading link: A secret delivered through a link or workflow intended to allow a single successful retrieval, after which access is invalidated. The exact guarantee depends on atomic server-side claiming, deletion behavior, client security, and whether the recipient copies the content.In Secretus: In Standard mode, Secretus invalidates the link after the first successful retrieval; ciphertext cleanup then follows the documented deletion workflow.
Penetration testing— Pentest: Authorized, scoped simulation of an attack to find exploitable weaknesses before someone unauthorized does. Distinguished from a vulnerability scan by the attempt at actual exploitation and chaining, and from a red team exercise by its focus on coverage rather than on testing whether defenders notice.
Plaintext / Ciphertext: Plaintext is the readable original data; ciphertext is its encrypted, scrambled form. Encryption turns plaintext into ciphertext with a key; decryption reverses it with the matching key.
Purple team: Offensive and defensive practitioners working together rather than in opposition — attacks are run openly so detection and response can be tuned against them in real time. The goal is improving detection coverage, not producing a scorecard.
Rate limiting: Capping how often an identity or address may perform an action, to blunt brute force, enumeration and resource abuse. Two properties decide whether it works: the limit must be keyed on something the caller cannot forge, and refusals must carry a Retry-After so well-behaved clients back off instead of hammering.
Responsible disclosure— Coordinated vulnerability disclosure, CVD: Reporting a vulnerability privately to whoever can fix it, agreeing a timeline, and publishing details once a fix is available. A bug bounty is one funding model for this, not a synonym: the disclosure process matters whether or not money changes hands.
Same-origin policy— SOP: The browser rule that scripts loaded from one origin — the combination of scheme, host and port — cannot read data from another. It is the foundation the rest of web security sits on; CORS is the controlled way to relax it, not a replacement for it.
Secrets management: The practices and tools used to create, store, distribute, rotate, revoke, and audit sensitive values such as API keys, passwords, certificates, and database credentials.
Secure boot: A startup sequence in which each stage verifies the signature of the next before handing over control, so unauthorized firmware or kernels do not run. It establishes a chain of trust rooted in hardware, and protects against persistence below the operating system.
Security audit: A structured assessment of controls, implementation, configuration, and evidence against a defined scope. An internal review, penetration test, certification, and independent cryptographic audit are different activities and should not be presented as interchangeable.
Threat intelligence— CTI: Analysed information about adversaries — their tooling, infrastructure and behaviour — turned into something defenders can act on. Useful intelligence changes a decision; a list of indicators with no context usually does not.
Threat model: An explicit statement of who you're defending against, what they can do, and what you're protecting. Good security starts here — 'encrypted' is meaningless until you say against whom.
Trust boundary: A point where data or control crosses between components with different trust levels — for example, from a browser into an API or from an application into a third-party service. Boundaries are where validation and authorization matter most.
Zero trust: A security approach that does not grant implicit trust based only on network location. Every access request is evaluated using identity, device, context, policy, and least privilege — it does not mean trusting nothing or buying one product.
Zero-knowledge architecture: A system design in which the service provider cannot read the data it stores or transmits, because it never holds the keys. Often used loosely; the meaningful version is a precise statement of what the servers do and don't see.In Secretus: For Secretus this means one thing specifically: servers do not receive plaintext secrets or decryption keys.

Category

Cryptography

The maths that turns readable data into protected data.

AEAD— Authenticated Encryption with Associated Data: Encryption that provides confidentiality and also detects unauthorized changes. It can authenticate unencrypted context — such as a protocol version or message number — alongside the ciphertext.
AES— Advanced Encryption Standard: The dominant symmetric cipher, standardized by NIST in 2001. AES-256 (256-bit key) is the common high-security choice; the GCM mode adds authentication so tampering is detected. Considered secure against classical and, for the key sizes used, quantum brute force.In Secretus: Async secrets are protected with browser-side AES-256-GCM.
AES-GCM— AES in Galois/Counter Mode: A widely used AEAD construction combining AES counter-mode encryption with an authentication tag. It is fast and strong when implemented correctly, but reusing a nonce with the same key can severely compromise security.In Secretus: Secretus Standard mode encrypts secret content with AES-256-GCM in the browser.
Asymmetric encryption— public-key cryptography: A scheme with a keypair: a public key that anyone can use to encrypt (or verify), and a private key that only the owner uses to decrypt (or sign). Solves the key-distribution problem symmetric crypto has.
Cryptographic erasure— crypto-shredding: Making encrypted data unreadable by securely destroying the only usable decryption keys. It can complement physical deletion, but works only when no key copies, plaintext copies, or recoverable backups remain.
CSPRNG— cryptographically secure pseudorandom number generator: A random-number generator designed so its output is unpredictable even after an attacker sees earlier output. Cryptographic keys, nonces, salts, and security tokens require a CSPRNG rather than ordinary application randomness.
Diffie-Hellman— DH / ECDH: The original public key-exchange method (1976): two parties derive a shared secret over a public channel. ECDH is the elliptic-curve variant — faster and smaller. Its security rests on the discrete-logarithm problem, which Shor's algorithm would break.
Digital signature: A public-key mechanism that lets others verify who signed data and that the data has not changed. It provides authenticity and integrity, not secrecy, and is different from a scanned handwritten signature.
Double Ratchet: An algorithm (popularized by Signal) that combines a symmetric-key ratchet with a Diffie-Hellman ratchet, giving forward secrecy and post-compromise recovery across an ongoing conversation.
ECDSA— Elliptic Curve Digital Signature Algorithm: A digital-signature algorithm based on elliptic-curve cryptography. Correct nonce generation and private-key protection are critical because a bad or reused signing nonce can reveal the private key.
Entropy: A measure of uncertainty or unpredictability. In security, sufficient entropy makes keys and tokens impractical to guess; a long-looking value generated predictably can still have very little real entropy.
Hash function: A one-way function that maps any input to a fixed-size fingerprint (digest). Good hashes (e.g. SHA-256) make it infeasible to reverse the input or find two inputs with the same digest. Used for integrity, signatures, and password storage.
HKDF— HMAC-based key derivation: A standard function that turns raw shared-secret material into one or more cryptographically strong keys of the right size and separation. Common as the final step after a key exchange.
HMAC: A keyed hash used to prove a message is authentic and untampered: only someone with the shared key can produce a valid tag. Distinct from encryption — it protects integrity, not confidentiality.
Hybrid key agreement: Combining a classical key exchange (like ECDH) with a post-quantum one (like ML-KEM), feeding both into a key-derivation function. An attacker must break both to recover the session key — hedging against either scheme being weakened.
KDF— Key Derivation Function: A function that derives one or more cryptographic keys from source material such as a shared secret or password. General-purpose KDFs such as HKDF and password KDFs such as PBKDF2 solve related but different problems.
KEM— Key-Encapsulation Mechanism: A three-part construction — key generation, encapsulation, and decapsulation — that lets two parties establish a shared secret over a public channel. ML-KEM is the NIST-standardized post-quantum example.
Key commitment: A property some AEAD constructions lack: standard AES-GCM ciphertext can, if deliberately crafted, decrypt successfully under two different keys and yield two different plaintexts. It matters wherever an attacker chooses keys and a recipient might accept either result; adding a commitment binds the ciphertext to exactly one key.
Key rotation: Replacing a cryptographic key on a schedule or after an event such as suspected compromise. Rotation limits how much data and time one key protects, but it does not retroactively repair data already exposed.
ML-KEM— Kyber, FIPS 203: Module-Lattice Key-Encapsulation Mechanism — a post-quantum key-exchange scheme standardized by NIST in 2024 (formerly CRYSTALS-Kyber). Its security rests on lattice problems for which no efficient quantum algorithm is known. ML-KEM-768 is the mid-strength parameter set.In Secretus: Maximum Security mode adds ML-KEM-768 hybrid post-quantum key agreement to protect against harvest-now-decrypt-later risk.
Nonce / IV— initialization vector: A number used once per encryption to ensure that encrypting the same plaintext twice yields different ciphertext. Reusing a nonce with the same key can catastrophically break modes like AES-GCM.
P-256— secp256r1, prime256v1: A standardized elliptic curve widely used for ECDH key agreement and ECDSA signatures. It provides classical security and is not designed to resist a sufficiently capable quantum computer running Shor's algorithm.In Secretus: Maximum Security uses P-256 for its classical ECDH and ECDSA components, combined with ML-KEM-768 for hybrid key agreement.
Password hashing— Argon2, bcrypt, scrypt, PBKDF2: Storing passwords as the output of a deliberately slow, salted, memory-hard function so that a stolen database cannot be reversed cheaply. General-purpose hashes such as SHA-256 are the wrong tool precisely because they are fast; Argon2id is the current default recommendation.
PBKDF2— Password-Based Key Derivation Function 2: A password KDF that repeatedly applies a pseudorandom function with a salt to make password guessing more expensive. Its security depends on a strong password and an appropriate iteration count; memory-hard KDFs provide stronger resistance in many password-storage settings.
Post-compromise security— PCS, self-healing: The property that a conversation can recover secrecy after a key compromise, once fresh key material is exchanged. A general goal of ratcheting protocols; strong claims about it require careful analysis or audit.
Post-quantum cryptography— PQC, quantum-resistant cryptography: Cryptographic algorithms designed to resist attacks by both classical and quantum computers. 'Post-quantum' describes the mathematical threat model, not proof against every future attack or implementation failure.
Ratchet— symmetric ratchet: A construction that derives a fresh key for every message and then discards the material needed to recompute past keys, so a later compromise can't decrypt earlier messages. A core idea behind modern secure messaging.In Secretus: Maximum Security uses a per-direction symmetric ratchet so each message gets its own key.
RSA: A classic public-key algorithm (1977) based on the difficulty of factoring large numbers. Still widely deployed, but vulnerable to a large enough quantum computer running Shor's algorithm — which is why the industry is migrating key exchange to post-quantum schemes.
Safety number— security code, key fingerprint: A short human-comparable representation of the parties' cryptographic identities or session material. Comparing it through a separate trusted channel helps detect an on-path attacker who substituted keys.In Secretus: Maximum Security requires the sender to confirm the displayed safety number before the secret can be sent.
Salt: Random data added to a password before hashing so that identical passwords produce different hashes, defeating precomputed 'rainbow table' attacks. Stored alongside the hash.
Shamir's Secret Sharing— SSS, k-of-n: A 1979 scheme (by Adi Shamir) that splits a secret into n shares so that any k reconstruct it, while k−1 shares reveal mathematically nothing. Used to remove single points of failure for high-value keys.In Secretus: Team Split runs Shamir's Secret Sharing k-of-n, creating and reconstructing shares client-side, with share material living in URL fragments rather than server storage.
Signal Protocol: The widely respected messaging-security protocol used by Signal, WhatsApp and others, combining X3DH key agreement with the Double Ratchet algorithm. Often referenced as the benchmark for end-to-end encrypted messaging.
SRP— Secure Remote Password: A password-authenticated key exchange in which the client proves it knows the password without sending it, and the server stores a verifier rather than anything password-equivalent. An eavesdropper — or the server itself during a single exchange — cannot recover the password, and offline guessing requires breaching the stored verifier first.
Symmetric encryption: Encryption that uses the same key to encrypt and decrypt. Fast and used for bulk data, but both sides must somehow share the key securely first.
URL fragment— hash fragment, #fragment: The part of a URL after '#'. Browsers use it locally and do not include it in the HTTP request to the origin server, which can make it useful for carrying client-side key material; it can still leak through screenshots, copied links, browser extensions, or a compromised device.In Secretus: Standard-mode decryption keys and Team Split share material are carried in URL fragments so Secretus servers do not receive them.
Web Crypto API— Web Cryptography API: A browser API exposing cryptographic primitives such as encryption, hashing, signing, verification, and key derivation. It reduces the need for handwritten cryptography but does not automatically make a protocol or application secure.In Secretus: Secretus uses the browser's Web Crypto API for its classical cryptographic operations; the ML-KEM-768 component uses a dedicated audited library.
X3DH— Extended Triple Diffie-Hellman: A key-agreement protocol that lets two parties establish a shared secret and authenticate each other using published prekey bundles — even if one party is offline when the other initiates.

Category

Attacks & threats

How adversaries actually get in — and get your secrets.

Account takeover— ATO: Gaining unauthorized control of another person's account through stolen credentials, session tokens, password resets, social engineering, or authentication weaknesses.
Broken access control: A failure to enforce what an authenticated user is allowed to do, letting attackers read or change data, invoke privileged functions, or cross tenant boundaries without authorization.
Brute force: Systematically trying every possible key or password until one works. Made infeasible by sufficient key length and slow, salted password hashing.
Business email compromise— BEC: Fraud in which an attacker impersonates or takes over a business email account to redirect payments, request sensitive data, or manipulate staff and suppliers. It often relies more on convincing context than malware.
Cache poisoning: Getting a shared cache — a CDN, a proxy, or DNS resolvers — to store a response the attacker controls, so it is then served to everyone else. Web cache poisoning usually abuses unkeyed inputs: headers that change the response but are not part of the cache key.
Clickjacking— UI redressing: Tricking a user into clicking a hidden or disguised interface element, often by placing a transparent target page inside a malicious frame. Frame restrictions and deliberate confirmation for sensitive actions help prevent it.
Command injection: Getting a program to run operating-system commands of your choosing, usually by slipping shell metacharacters such as ; | $() into a value it passes to a shell. The reliable defence is not to build a shell string at all: invoke the program directly with an argument list, so user input can never be read as syntax.
Credential stuffing: Automatically trying username/password pairs leaked from one breach against many other sites, exploiting password reuse. Cheap, scalable, and defeated mainly by unique passwords plus MFA.
Cross-Site Request Forgery— CSRF, XSRF: Forcing a signed-in user's browser to submit an unwanted state-changing request to another site that automatically receives the user's credentials. SameSite cookies, anti-CSRF tokens, and origin checks are common defenses.
Data exfiltration: Unauthorized removal of data from a device, application, or network. Attackers may hide it in normal web traffic, cloud storage, DNS queries, email, or encrypted channels to evade detection.
Dependency confusion— Namespace confusion: Publishing a package to a public registry using the same name as one of a company's internal, private packages. Build tooling configured to check both may prefer the public one — often because it carries a higher version number — and install the attacker's code instead. Scoped names and registry pinning are the usual mitigations.
Deserialization attack— Insecure deserialization: Feeding crafted serialized data to a program that rebuilds objects from it without validation. In languages where deserialization can invoke constructors or magic methods, this frequently escalates straight to remote code execution. Treat serialized input from outside a trust boundary as hostile, and prefer formats that carry data rather than typed objects.
Harvest now, decrypt later— HNDL, store-now-decrypt-later: Recording encrypted traffic today to decrypt it in the future once quantum computers can break the key exchange. No decryption is needed now — only storage and patience. A live threat for anything with a long secrecy lifetime.In Secretus: Maximum Security adds ML-KEM-768 hybrid post-quantum protection specifically against harvest-now-decrypt-later risk.
Homograph attack— IDN homograph, look-alike domain: Registering a name that renders almost identically to a legitimate one by using characters from other scripts — a Cyrillic 'а' in place of a Latin 'a', for instance. Used for phishing domains and, in package registries, alongside typosquatting.
HTTP request smuggling: Exploiting a disagreement between two servers in a chain — typically a proxy and the origin behind it — about where one HTTP request ends and the next begins, usually by sending conflicting Content-Length and Transfer-Encoding headers. The attacker's smuggled request is then attributed to another user's connection. A specific and dangerous case of a parser differential.
IDOR— Insecure Direct Object Reference, BOLA: An access-control flaw where changing an identifier in a request exposes another user's object because the server checks that the object exists but not that the requester may access it. In APIs it is also called Broken Object Level Authorization.
Infostealer— information-stealing malware: Malware specialized in stealing browser cookies, saved passwords, cryptocurrency wallets, files, and authentication tokens, then sending them to an operator or criminal marketplace.
Insider threat: Risk originating from someone who already has legitimate access — an employee, contractor or partner — whether they act maliciously, are coerced, or simply make a costly mistake. Least privilege, separation of duties and meaningful audit logging matter more here than any perimeter control.
Living off the land— LOTL, LOLBins: Conducting an intrusion using tools already present on the target — PowerShell, certutil, scheduled tasks, remote-management agents — instead of bringing custom malware. It leaves little for signature-based detection to find, so defence relies on spotting unusual use of normal tools.
Malware: Software intentionally designed to harm, spy on, disrupt, or gain unauthorized access to systems. Ransomware, trojans, worms, spyware, and infostealers are malware categories, not interchangeable names.
Man-in-the-middle— MITM, on-path attack: An attacker secretly positioned between two parties, relaying and possibly altering traffic while each side believes it's talking directly to the other. End-to-end encryption with authentication is the defense.
MFA fatigue— push bombing, MFA bombing: Flooding a target with authentication prompts and pressuring them to approve one. Number matching, phishing-resistant security keys or passkeys, and rate limits reduce this risk.
MIME sniffing— Content sniffing: A browser guessing a resource's type from its bytes rather than trusting the declared Content-Type. Combined with a weak upload filter it can turn a file stored as an image into an executed script. Sending X-Content-Type-Options: nosniff tells browsers not to guess. Note that a type is structured, not a plain string: image/svg+xml; charset=utf-8 and image/svg+xml are the same type, so comparisons must be made on the essence rather than the whole header value.
Open redirect: A flaw where a trusted site redirects to an attacker-controlled URL supplied through unvalidated input. It enables convincing phishing links and can weaken OAuth or server-side request protections when chained with other bugs.
Parser differential— Parsing discrepancy: A vulnerability that exists because two components read the same input differently, where one makes a security decision and the other performs the action. A URL library and an HTTP client that disagree about which part is the hostname can turn an allow-list check into an SSRF. The structural fix is to parse once, with the component that will act, and pass the parsed object onward instead of re-parsing the original string.
Password spraying: Trying a small number of very common passwords against a very large number of accounts, rather than many passwords against one. Because each account sees only a handful of attempts, it slips under lockout thresholds that would stop a brute-force attack.
Path traversal— Directory traversal, dot-dot-slash: Supplying a filename containing ../ (or an encoded form of it) so that a program reads or writes a file outside the directory it intended to stay inside. Classic targets are configuration files, credentials and SSH keys. The robust fix is to resolve the path to an absolute one and verify it is still inside the permitted directory, rather than scanning the raw input for suspicious sequences.
Phishing: Tricking a person into revealing credentials or running malware, usually via a fake email, message, or login page that impersonates a trusted party. Still the single most common initial-access technique.
Privilege escalation— PrivEsc, LPE: Turning limited access into higher access — from a normal user to administrator/root, or from one account into another's. Often the step between initial foothold and full compromise.
Prototype pollution: A JavaScript-specific flaw where attacker-controlled keys such as __proto__ or constructor.prototype are merged into an object, changing behaviour for every object in the program. Consequences range from bypassed authorization checks to remote code execution, depending on what later reads the polluted property.
Race condition— TOCTOU, time-of-check to time-of-use: A flaw where the result depends on the timing of concurrent operations, classically when a value is checked and then used with a gap in between during which it can change. Security examples include two simultaneous requests each passing a one-time check, or a file being swapped for a symlink between the permission check and the open.In Secretus: One-time delivery is enforced by a claim-then-consume sequence rather than a check followed by a separate read, so two simultaneous requests for the same secret produce exactly one delivery and one refusal.
Ransomware: Malware that encrypts a victim's files (and increasingly exfiltrates them first) then demands payment for the key. 'Double extortion' adds the threat of leaking the stolen data publicly.
Replay attack: Capturing a valid message or token and re-sending it later to impersonate the original sender or repeat an action. Defended with nonces, timestamps, and sequence numbers.
Server-Side Request Forgery— SSRF: Making a vulnerable server send attacker-chosen network requests. SSRF can reach internal services, cloud metadata endpoints, or trusted networks that are inaccessible directly from the internet.
Session fixation: Forcing a victim to use a session identifier the attacker already knows — for example by planting it in a link — so that the attacker inherits the session once the victim authenticates. Prevented by issuing a fresh session identifier at every privilege change, especially at login.
Session hijacking— cookie theft, token theft: Taking over an authenticated session by stealing, predicting, or fixing its session token. An attacker may bypass the password and MFA because the application sees the stolen token as an already authenticated session.
Side-channel attack: Extracting secrets from a system's physical behavior — timing, power draw, electromagnetic emissions, cache effects — rather than breaking the algorithm itself.
SIM swapping— SIM hijacking: Convincing or compromising a mobile carrier to move a victim's phone number to an attacker-controlled SIM or eSIM, allowing interception of calls and SMS-based recovery or authentication codes.
Social engineering: Manipulating people rather than technology — pretexting, urgency, authority, help-desk impersonation — to obtain access or secrets. The human layer is often the softest target.
Spear phishing: Targeted phishing tailored to a specific person or organization using researched details (names, projects, vendors) to appear legitimate. Whaling is spear phishing aimed at executives.
Supply chain attack: Compromising a trusted upstream dependency — a software library, build system, or vendor — to reach that supplier's many downstream customers at once. SolarWinds and XZ Utils are canonical examples.
Typosquatting: Registering look-alike domains or publishing similarly named software packages to catch typing mistakes and impersonate a trusted brand or dependency. It is commonly used for phishing and supply-chain compromise.
Watering hole: Compromising a website the intended victims are known to visit, so the malware is delivered to them indirectly through a site they already trust.
Worm: Malware that spreads by itself, without a user opening anything. Modern supply chain worms propagate through package registries: the payload steals a maintainer's publishing token, then republishes itself into that maintainer's packages, reaching hundreds of projects within hours.
Zero-day— 0-day: A vulnerability unknown to the vendor (and thus unpatched) at the time it's exploited — defenders have had 'zero days' to fix it. Highly valuable to attackers precisely because no patch exists.

Category

Abbreviations & frameworks

Acronyms, protocols, standards, and EU cyber rules — decoded.

API— Application Programming Interface: A defined way for software systems to communicate. APIs expose operations and data to other programs, so authentication, authorization, validation, rate limits, and versioning are central security concerns.
APT— Advanced Persistent Threat: A well-resourced, stealthy adversary — usually state-linked — that gains long-term access to a target and pursues strategic goals (espionage, sabotage) over months or years rather than a quick smash-and-grab.
BCP / DR— Business Continuity Planning / Disaster Recovery: Related disciplines for keeping critical operations running through disruption and restoring technology afterward. BCP covers the broader business; disaster recovery focuses on systems, data, dependencies, and tested restoration procedures.
C2— C&C, command and control: The infrastructure an attacker uses to communicate with and control compromised machines — issuing commands and receiving stolen data. Detecting C2 traffic is a core defensive goal.
CISO— Chief Information Security Officer: The executive responsible for an organization's information-security program, including risk, governance, incident readiness, security operations, and communication with leadership and regulators.
CORS— Cross-Origin Resource Sharing: The mechanism by which a server tells browsers that a specific other origin may read its responses, relaxing the same-origin policy. It is frequently mistaken for an access control: CORS restrains browsers, not attackers, and any non-browser client can send whatever Origin header it likes. Authorization must still be enforced with credentials the server verifies.
CRA— EU Cyber Resilience Act: An EU regulation establishing lifecycle cybersecurity and vulnerability-handling requirements for many hardware and software products with digital elements placed on the EU market.
CSIRT— Computer Security Incident Response Team: A team that coordinates preparation for, analysis of, response to, and recovery from cybersecurity incidents. CERT is a closely related name used by many national and organizational teams.
CSP— Content Security Policy: A browser-enforced policy that restricts which scripts, styles, frames, connections, and other resources a page may load. A strict CSP reduces the impact and exploitability of many content-injection flaws, especially XSS.
CVE— Common Vulnerabilities and Exposures: A public catalog assigning each disclosed vulnerability a unique identifier (e.g. CVE-2024-3094), so everyone refers to the same flaw unambiguously.
CVSS— Common Vulnerability Scoring System: A standard 0–10 severity score for vulnerabilities, factoring in how easily and how severely a flaw can be exploited. Helps teams prioritize patching.
CWE— Common Weakness Enumeration: A catalogue of vulnerability classes — the type of flaw, such as CWE-22 path traversal — as distinct from a CVE, which identifies one specific vulnerability in one specific product. CWE describes what went wrong in general; CVE says where.
DDoS— Distributed Denial of Service: Overwhelming a service with traffic from many sources so legitimate users can't reach it. About availability, not data theft — though sometimes used as a smokescreen.
DKIM— DomainKeys Identified Mail: A cryptographic signature added to outgoing mail, verifiable against a public key in the sending domain's DNS. It proves the message was authorised by that domain and has not been altered in transit — but says nothing by itself about whether the signing domain matches the visible sender.
DLP— Data Loss Prevention: Controls that discover sensitive data and monitor or block unauthorized movement through endpoints, networks, email, browsers, and cloud services. DLP reduces leakage risk but cannot replace sound access control and data minimization.
DMARC— Domain-based Message Authentication, Reporting and Conformance: A policy layered on SPF and DKIM that requires one of them to both pass and align with the visible From: domain, and tells receivers what to do when neither does — monitor, quarantine or reject. Its aggregate reports show who is sending as your domain, which is the part most organisations publish and then never read.
DNS— Domain Name System: The distributed naming system that maps domain names to network information such as IP addresses. DNS hijacking, poisoning, and misconfiguration can redirect users even when the application itself is unchanged.
DORA— EU Digital Operational Resilience Act: An EU regulation for the financial sector covering ICT risk management, incident reporting, resilience testing, information sharing, and oversight of third-party technology risk.
EDR— Endpoint Detection and Response: Software on endpoints (laptops, servers) that monitors behavior to detect, investigate, and respond to threats that slip past prevention. XDR extends this across more data sources.
EPSS— Exploit Prediction Scoring System: A probability that a given vulnerability will be exploited in the next 30 days, derived from observed activity. It answers a different question from CVSS — likelihood rather than severity — and the two are most useful read together.
GDPR— General Data Protection Regulation: The EU's general framework for processing personal data, built around lawful purpose, transparency, minimization, security, accountability, and individual rights. Encryption can reduce risk but does not automatically take data outside GDPR.
HSTS— HTTP Strict Transport Security: A response header instructing browsers to contact a site only over HTTPS for a stated period, removing the initial plaintext request an attacker could intercept and downgrade. Preloading ships the rule with the browser so even the very first visit is protected.
IAM— Identity and Access Management: The discipline and tooling for controlling who can access what — identities, roles, permissions, and their lifecycle. SSO and MFA live here.
ICE— Interactive Connectivity Establishment: The WebRTC process that gathers and tests possible network paths between peers, using direct candidates where possible and relays where necessary. ICE negotiates connectivity; it is not itself the application encryption protocol.
IOC— Indicator of Compromise: A forensic artifact suggesting a breach — a malicious file hash, IP address, domain, or registry key — shared so others can detect the same intrusion.
JWT— JSON Web Token: A compact signed or encrypted token format carrying claims between parties. JWTs are not inherently secret and must be validated for signature, algorithm, issuer, audience, time limits, and application-specific authorization.
KEV— Known Exploited Vulnerabilities catalog: CISA's list of vulnerabilities with confirmed exploitation in the wild, carrying binding remediation deadlines for US federal agencies and widely used elsewhere as a patching priority. Presence on KEV is a far stronger signal than a high CVSS score alone.
MFA / 2FA— multi-factor / two-factor authentication: Requiring more than just a password — something you have (a code, security key) or are (biometric) — so a stolen password alone isn't enough. TOTP apps and hardware keys are common second factors.In Secretus: Secretus accounts support TOTP-based multi-factor authentication.
NIS2— Network and Information Systems Directive 2: The EU cybersecurity directive expanding risk-management, incident-reporting, supply-chain, governance, supervision, and enforcement requirements across essential and important sectors.
OAuth 2.0: A delegated authorization framework: it lets an application obtain limited access to a resource on a user's behalf without handling their password. It is an authorization protocol, not an authentication one — using it to establish identity is what OpenID Connect exists to do properly.
OAuth 2.0 / OIDC— Open Authorization / OpenID Connect: OAuth 2.0 delegates access to APIs; OpenID Connect adds an identity layer for sign-in. They are commonly used together, but access tokens, ID tokens, redirect validation, state, nonce, and PKCE have distinct security roles.
OpenID Connect— OIDC: An identity layer on top of OAuth 2.0 that adds a signed ID token describing who the user is. The token's issuer, audience and signature must all be verified by whoever relies on it; accepting an unverified token is a recurring and severe implementation flaw.
OSINT— Open-Source Intelligence: Intelligence gathered from publicly available sources — social media, public records, leaked databases, code repos. The reconnaissance backbone of both attackers and defenders.
PAM— Privileged Access Management: Processes and tools for controlling, monitoring, approving, and rotating access to high-impact administrator, root, service, and infrastructure accounts.
PII— Personally Identifiable Information: Data that identifies a specific person — name, email, ID number, address. Its handling is governed by laws like GDPR, and it's a prime target in breaches.
PKCE— Proof Key for Code Exchange: An OAuth extension that binds an authorization request to the client that started it, preventing a stolen authorization code from being redeemed by another party. It is especially important for browser and mobile clients.
RaaS— Ransomware as a Service: A criminal business model in which operators maintain ransomware and supporting infrastructure while affiliates compromise victims and deploy it, sharing extortion proceeds with the operators.
RAT— Remote Access Trojan: Malware giving an attacker covert remote control of an infected machine — keystrokes, files, camera, microphone — typically communicating back to C2 infrastructure.
RBAC— Role-Based Access Control: An authorization model that assigns permissions to roles and roles to users or services. It simplifies administration, but overly broad or stale roles can still violate least privilege.
RCE— Remote Code Execution: A vulnerability that lets an attacker run arbitrary code on a target over the network — one of the most severe classes, since it typically means full control.
RPO / RTO— Recovery Point Objective / Recovery Time Objective: RPO is the maximum acceptable amount of data loss measured in time; RTO is the target time to restore a service after disruption. Backups and recovery plans should be tested against both objectives.
SBOM— Software Bill of Materials: A machine-readable inventory of software components and dependencies in a product. It supports vulnerability response and supply-chain visibility, but an SBOM alone does not prove that software is secure.
SIEM— Security Information and Event Management: A platform that aggregates and correlates logs and events across an organization to detect, alert on, and investigate security incidents.
SLA— Service Level Agreement: A contractual commitment defining measurable service levels such as uptime, response times, support windows, remedies, and exclusions. A public status page or best-effort support statement is not an SLA.
SOC— Security Operations Center: The team (and facility) that monitors, detects, and responds to security events around the clock. Not to be confused with SOC 2, an auditing standard for service organizations.
SPF— Sender Policy Framework: A DNS record listing which servers may send mail for a domain. Receivers check the sending IP against it. On its own it validates the envelope sender rather than the From: address a person actually sees, which is why it is paired with DKIM and DMARC.
SQLi— SQL Injection: Injecting malicious SQL through unsanitized input to read, alter, or destroy a database. A decades-old class still causing breaches; parameterized queries are the fix.
SRI— Subresource Integrity: A cryptographic hash placed on a script or stylesheet tag so the browser refuses the file if its contents do not match. It limits the damage when a CDN or third-party host serving your assets is compromised.
SSO— Single Sign-On: An authentication arrangement that lets one trusted identity provider sign a user into multiple services. It reduces password sprawl but makes the identity provider and its recovery process especially high-value targets.
STUN / TURN— Session Traversal Utilities for NAT / Traversal Using Relays around NAT: Protocols used by WebRTC to cross NAT and firewall boundaries. STUN helps peers discover reachable addresses; TURN relays traffic when a direct path cannot be established.
TLS— Transport Layer Security: The protocol behind HTTPS that encrypts and authenticates a network connection between endpoints such as a browser and a server. TLS protects data in transit but is not the same as end-to-end encryption when an intermediary terminates the connection.
TOTP— Time-Based One-Time Password: A short code generated from a shared secret and the current time, commonly used as a second authentication factor. TOTP is stronger than password-only access but can still be phished in real time.In Secretus: Secretus accounts support TOTP-based multi-factor authentication.
TTP— Tactics, Techniques and Procedures: The characteristic behavior of a threat actor — how they operate at each stage — catalogued in frameworks like MITRE ATT&CK. Harder for attackers to change than a mere IP or hash.
VPN— Virtual Private Network: An encrypted tunnel connecting a device or network to a VPN endpoint. It protects traffic on the path to that endpoint and can provide private-network access, but it does not make unsafe endpoints or applications trustworthy.
WAF— Web Application Firewall: A filter in front of a web app that inspects HTTP traffic to block common attacks like SQLi and XSS before they reach the application.
WebRTC— Web Real-Time Communication: A set of browser technologies for real-time peer connectivity, media, and data channels. Signaling is handled separately, and ICE may select a direct route or a TURN relay depending on network conditions.In Secretus: Maximum Security sends the secret payload browser-to-browser over a WebRTC data channel; a relay may carry encrypted traffic when a direct network path is unavailable.
XSS— Cross-Site Scripting: A web flaw where an attacker injects malicious script into a page other users view, running in their browser session to steal data or tokens. Mitigated by output encoding and Content-Security-Policy.

Category

APT groups

Well-known state-linked and organised threat actors, with their common aliases.

APT1— Comment Crew, PLA Unit 61398: A Chinese group whose large-scale intellectual-property theft was detailed in a landmark 2013 Mandiant report that publicly tied the activity to a specific military unit — a turning point in threat attribution.
APT10— Stone Panda, MenuPass: A Chinese espionage group known for 'Cloud Hopper' — compromising managed service providers to reach their clients downstream, a supply-chain approach to mass espionage.
APT28— Fancy Bear, Sofacy, Sednit: A long-running espionage group widely attributed by Western governments to Russian military intelligence (GRU). Known for targeting governments, militaries, and political organizations, including high-profile election-related intrusions.
APT29— Cozy Bear, Midnight Blizzard, The Dukes: A stealthy espionage group widely attributed to Russia's SVR foreign-intelligence service. Associated with the SolarWinds supply-chain compromise and sustained, patient intrusions into government and tech targets.
APT41— Barium, Winnti, Wicked Panda, Wicked Spider: A China-linked threat cluster known for broad espionage campaigns and financially motivated activity. Public reporting associates it with software supply-chain compromises, theft of source code and signing certificates, ransomware, and cryptojacking.
Charming Kitten— APT35, Mint Sandstorm, Phosphorus: A group attributed to Iran, focused on espionage against journalists, academics, activists, and government targets, frequently using elaborate social-engineering and fake personas.
Equation Group: A highly sophisticated actor widely linked in public reporting to the U.S. NSA, known for advanced implants and firmware-level persistence. Some of its tools later leaked publicly, fueling other attacks.
Kimsuky— Velvet Chollima, APT43: A North Korea-attributed group specializing in intelligence collection against think tanks, foreign-policy experts, and researchers, largely through spear phishing and credential theft.
Lazarus Group— APT38, Hidden Cobra: A group attributed to North Korea, notable for blending espionage with financially motivated operations — bank heists, cryptocurrency theft, and the 2017 WannaCry ransomware outbreak.
LockBit— LockBit 3.0, LockBit Black: A prolific ransomware-as-a-service operation whose affiliates have attacked organizations across many sectors. International law enforcement disrupted major parts of its infrastructure in Operation Cronos, illustrating that a ransomware brand, operators, affiliates, and malware are related but distinct.
OceanLotus— APT32: A group attributed to Vietnamese interests, targeting foreign companies, dissidents, and governments across Southeast Asia, often via tailored phishing and watering-hole attacks.
Salt Typhoon— Operator Panda, RedMike, UNC5807: An industry label overlapping with PRC state-sponsored activity targeting telecommunications providers, backbone routers, government, transport, and other networks for persistent access and espionage. Vendor labels do not always map one-to-one to the same actors.
Sandworm— Voodoo Bear, APT44: A destructive group attributed to Russian military intelligence, linked to attacks on Ukraine's power grid and the NotPetya wiper (2017), one of the costliest cyberattacks in history.
Scattered Spider— UNC3944, Octo Tempest, Oktapus, Muddled Libra: A financially motivated cybercriminal cluster known for targeting large organizations and their help desks with convincing social engineering, SIM swapping, MFA fatigue, data theft, extortion, and ransomware partnerships.
Turla— Snake, Venomous Bear: A technically advanced espionage group attributed to Russia, known for novel techniques including satellite-based command-and-control and long-term intrusions into government and diplomatic targets.
Volt Typhoon— Vanguard Panda, Bronze Silhouette, Voltzite: A PRC state-sponsored group publicly associated with long-term access to critical infrastructure. It is known for living-off-the-land techniques and pre-positioning that could support disruption during a future crisis rather than conventional smash-and-grab intrusion.
Wizard Spider: A financially motivated cybercrime group behind the TrickBot malware and Ryuk/Conti ransomware operations, responsible for widespread extortion against enterprises and healthcare providers.

From definition to delivery

Put the theory to work.

Start a 14-day trial to send an end-to-end encrypted, one-time link. Recipients need no account.

Try Secretus Read the blog