Common Type Terminology

• Abstract class: A class that contains one or more pure virtual functions and cannot be instantiated.
• Access control: The process of regulating access to a system or resource, often based on user roles and permissions.
• Advanced Encryption Standard (AES): A symmetric key encryption standard that is widely used to secure sensitive data.
• Advanced Evasion Techniques (AETs): Techniques used by attackers to evade detection and bypass security controls.
• Advanced persistent threat (APT): A type of cyber attack that is characterized by a prolonged and targeted intrusion into an organization’s network, often with the goal of stealing sensitive data or disrupting operations.
• Agile development: A methodology for software development that emphasizes flexibility, collaboration, and rapid iteration over strict planning and execution.
• AI: Artificial Intelligence, refers to the simulation of human intelligence in machines that are programmed to think and learn like humans.
• Application security: The practice of securing software applications from design to deployment and ongoing maintenance.
• Archiving: The process of moving less frequently accessed data to a separate storage location, often used to reduce the cost and complexity of backup and recovery.
• Array: A collection of values, typically of the same data type, stored in a single variable.
• Atomic operation: An operation that is guaranteed to be executed in its entirety, without interruption from other operations, often used for low-level memory and concurrency management.
• Auditing: The process of collecting and analyzing system and security-related information to monitor and detect suspicious activity, often used for compliance, security, and forensic purposes.
• Authorization: The process of granting or denying access to a system or resource based on the user’s identity and permissions.
• Backup: The process of creating copies of data to protect against data loss, often involving backup software, backup storage, and backup schedules.
• Behavioral analytics: The process of analyzing user and system behavior to detect anomalies and potential security threats.
• Bit shifting: An operation that shifts the bits of a binary value to the left or right, often used for efficient multiplication and division by powers of 2.
• Bitwise operation: An operation that manipulates the individual bits of a binary value, such as AND, OR, and XOR.
• Blockchain: A decentralized and distributed digital ledger that is used to record transactions across multiple computers.
• Boolean: A data type that can have one of two values, typically represented as “true” or “false”.
• Bullet Point List All Type: Terminology and Related Definitions.
• Business continuity: The process of maintaining critical business operations during a disruption, often involving business continuity plans, business continuity exercises, and business continuity management.
• Center for Internet Security (CIS): A non-profit organization that provides best practice guidelines and a comprehensive framework for securing information systems and networks.
• Class: A blueprint for creating objects, often used in object-oriented programming.
• Cloud Access Security Broker (CASB): A security solution that sits between an organization’s on-premises infrastructure and cloud-based services, providing visibility and control over cloud usage and data.
• Cloud computing: The delivery of computing services—including servers, storage, databases, networking, software, analytics, and intelligence—over the Internet (“the cloud”) to offer faster innovation, flexible resources, and economies of scale.
• Cloud native: A term that refers to the design and development of applications that are built to run in the cloud, leveraging its scalability, availability, and automation features.
• Cloud Security Alliance (CSA): A not-for-profit organization that promotes the use of best practices for providing security assurance within Cloud Computing.
• Cloud security posture management (CSPM): The practice of continuously monitoring and managing the security of cloud resources and environments.
• Cloud security: The practice of protecting data, applications, and infrastructure in the cloud from unauthorized access and attacks.
• Code review: The process of reviewing code changes before they are merged into the main codebase, often used to ensure code quality, maintainability, and compliance with coding standards.
• Compliance: The process of ensuring that an organization adheres to legal, regulatory, and industry-specific standards and best practices.
• Concurrency: The ability of a system to perform multiple tasks at the same time, often achieved through multi-threading or event-driven programming.
• Condition variable: A synchronization object that allows threads to wait for a certain condition to be met before proceeding.
• Constant: A variable whose value cannot be changed once it is assigned.
• Container security: The practice of securing containerized applications and infrastructure, including the host, runtime and the container images.
• Containerization: A method of packaging software so that it can run consistently across different environments, isolating it from its surroundings and making it easier to manage.
• Continuous delivery: The practice of automatically delivering code changes to a staging or production environment as soon as they pass testing, often used to minimize the time between code changes and their availability to users.
• Continuous deployment: The practice of automatically deploying code changes to a production environment as soon as they pass testing, without the need for manual intervention.
• Continuous integration: The practice of automatically building, testing, and deploying code changes as soon as they are committed to the codebase, often used to catch and fix errors early and ensure that the codebase remains in a releasable state at all times.
• Cryptocurrency: A digital or virtual currency that uses cryptography for security, decentralized in nature and operates independently of a central bank.
• Cryptography: The practice of securing communications and data by applying mathematical algorithms, often used for encryption, authentication, and integrity checking.
• Cyber espionage: The use of cyber capabilities to gather intelligence or steal sensitive information from an organization or government.
• Cyber Hygiene: The practice of maintaining good cybersecurity habits and best practices to reduce the risk of cyber attacks.
• Cyber insurance: Insurance that helps protect an organization from financial losses caused by cyber-attacks, data breaches, and other cybersecurity incidents.
• Cyber Kill Chain: A methodology developed by Lockheed Martin, to describe the stages of a cyber attack, from initial reconnaissance to exfiltration of data.
• Cyber liability: The legal and financial responsibility for losses or damage caused by a cyber-attack or data breach.
• Cyber Range: A simulated network environment used to train cybersecurity professionals and test security systems and incident response plans.
• Cyber Resilience: The ability of an organization to prepare for, withstand, and quickly recover from cyber attacks and other disruptive events.
• Cyber Situational Awareness: The practice of collecting and analyzing information about the threat landscape, vulnerabilities, and risks to an organization, in order to make informed security decisions.
• Cyber threat intelligence: The process of collecting, analyzing, and disseminating information about cyber threats and adversaries in order to inform security decisions and actions.
• Cyber warfare: The use of cyber capabilities to conduct military operations against an adversary.
• Cybercrime: Criminal activities that are committed using the internet or other forms of digital communication.
• Cybersecurity: The practice of protecting systems, networks, and data from digital attacks and breaches.
• Data deduplication: The process of eliminating redundant copies of data, often used to reduce the amount of storage required and improve backup and recovery performance.
• Data Loss Prevention (DLP): The practice of detecting and preventing the unauthorized sharing, copying or removal of sensitive or confidential data.
• Data replication: The process of creating copies of data on multiple servers or storage devices, often used to improve data availability and reduce the impact of data loss.
• Data Type Terminology List
• DDoS protection: A set of techniques and technologies used to protect against distributed denial-of-service attacks, which attempt to overwhelm a system or network with traffic from multiple sources.
• Deadlock: A condition where two or more processes are blocked and unable to proceed, often caused by a circular dependency between the processes.
• Deadlock: A situation where two or more processes are blocked and unable to proceed, often caused by a circular dependency between the processes.
• Deception technology: The use of decoy systems, data, and networks to mislead and detect malicious actors.
• Deserialization: The process of converting a stored or transmitted format back into an object’s state, often used to recreate an object from its serialized form.
• DevOps: A set of practices that aims to increase collaboration and communication between development and operations teams, promoting faster and more efficient delivery of software.
• Dictionary: A collection of key-value pairs, where each key is associated with a value.
• Digital certificate: An electronic document that binds a public key to an identity, often used for authentication and secure communication.
• Digital signature: A value that is calculated using a private key, and can be verified using the corresponding public key, often used to ensure the authenticity and integrity of digital documents and communications.
• Disaster recovery: The process of restoring an organization’s IT infrastructure and operations after a disaster, often involving disaster recovery plans, disaster recovery sites, and disaster recovery testing.
• Distributed computing: A technique in which a problem is broken down into smaller tasks that can be executed simultaneously across multiple machines or devices, often used for parallel processing and scalability.
• Dynamic allocation: The process of allocating memory during runtime, as opposed to at compile time.
• Edge computing: A distributed computing paradigm that brings computation and data storage closer to the source of the data.
• Encapsulation: A mechanism in object-oriented programming that restricts direct access to an object’s data and behavior, promoting encapsulation and modularity.
• Encryption: The process of converting plaintext into ciphertext, making it unreadable to anyone without the decryption key.
• Endpoint Detection and Response (EDR): A security solution that monitors and analyzes endpoint activity to detect and respond to security incidents.
• Endpoint Protection: The practice of protecting endpoint devices such as computers, laptops, servers, mobile devices, and IoT devices from malware, unauthorized access, and other threats.
• Endpoint security: The practice of protecting devices, such as laptops, mobile phones and tablets, from unauthorized access and attacks.
• Enumeration: A set of named values, often used to define a set of options or states.
• Event-driven programming: A programming paradigm in which the flow of the program is determined by events, such as user input or system notifications.
• Failover: The process of switching to a redundant system or component in the event of a failure, often used to improve availability and reduce downtime.
• Federated Identity: A mechanism that allows an organization to use an external identity provider to authenticate its users.
• Firewall: A security device or software that monitors and controls incoming and outgoing network traffic, often used to block unauthorized access and protect against malicious attacks.
• Floating-point: A number with a decimal point, also known as a “float”.
• Function: A block of code that performs a specific task and can be reused throughout a program.
• Garbage collection: The process of automatically freeing memory that is no longer being used by a program.
• Generics: A feature in certain programming languages that allows a function, class, or interface to work with multiple types of data, rather than being tied to a specific type.
• Governance: The process of establishing and maintaining policies, standards, and procedures to ensure that an organization’s IT resources are used in an efficient, effective, and compliant manner.
• Hashing: The process of converting plaintext into a fixed-length, irreversible value, often used for password storage and integrity checking.
• Heap: A memory area that stores long-term data, such as dynamically allocated memory.
• High availability: The ability of a system to continue functioning with minimal disruption, often achieved through redundancy and failover mechanisms.
• Hypertext Transfer Protocol Secure (HTTPS): A protocol for securely transmitting data over the internet, often used for online banking and e-commerce.
• Identity and access management (IAM): The security discipline that deals with the management of digital identities, including their creation, maintenance, usage, and revocation.
• Identity Governance and Administration (IGA): The practice of managing and controlling access to systems and applications based on the identity of the user.
• Incident management: The process of identifying, assessing, and resolving security incidents in a timely and efficient manner.
• Incident response plan: A set of procedures and guidelines for identifying, responding to, and recovering from security incidents.
• Incident response team: A group of individuals with specific roles and responsibilities for identifying, responding to, and recovering from security incidents.
• Incident response: The process of identifying, containing, and recovering from a security incident, often involving incident response teams, incident response plans, and incident response exercises.
• Information security: The practice of protecting sensitive information from unauthorized access, use, disclosure, disruption, modification, or destruction.
• Inheritance: A mechanism in object-oriented programming that allows one class to inherit properties and methods from another class.
• Integer: A whole number, positive or negative, without a decimal point.
• International Organization for Standardization (ISO): A non-governmental organization that provides international standards for various industries, including information security.
• Internet of Things (IoT) security: The practice of securing IoT devices and networks, including the device firmware, communication protocols, and cloud-based management platforms.
• Intrusion detection and prevention: The process of detecting and preventing unauthorized access to a system, often through the use of sensors, analyzers, and software.
• IoT: Internet of Things, refers to the interconnected devices and appliances that can communicate and share data via the internet.
• Key exchange: The process of securely exchanging keys between parties, often used to establish a secure communication channel.
• Kubernetes: An open-source container orchestration system for automating the deployment, scaling, and management of containerized applications.
• Lambda function: A small, anonymous function that can be defined without a name.
• Load testing: The process of subjecting a system to a realistic load, often used to identify and fix performance bottlenecks and ensure that the system can handle expected usage patterns.
• Machine learning: A subset of AI that deals with the development of algorithms and statistical models that enable systems to automatically improve their performance with experience.
• Malware: Short for malicious software, malware refers to any software that is designed to cause harm to a computer system or network, including viruses, worms, trojans, and ransomware.
• Marshalling: The process of converting an object’s state to a format that can be transmitted across a network or inter-process boundary, often used for communication and remoting.
• Memory allocation: The process of reserving a specific amount of memory for a variable or data structure.
• Memory barrier: A synchronization mechanism that ensures that certain memory operations are completed before other operations are allowed to proceed.
• Memory leak: A condition where a program continues to consume memory after it is no longer needed, eventually causing the program to crash or the system to become unresponsive.
• Meta-programming: A technique in which a program generates or manipulates other programs, often used for code generation, optimization, and reflection.
• Method: A function that is associated with an object.
• microservices: An architectural style where a single application is composed of small, independently deployable services.
• Middleware: Software that sits between an application and the underlying system, providing services such as communication, security, and persistence.
• Mobile device management (MDM): The practice of securing, managing and monitoring mobile devices in an organization.
• Multi-Factor Authentication (MFA): The practice of using multiple forms of authentication, such as a password and a fingerprint or a token, to verify the identity of a user.
• Multi-threading: The ability of a program to execute multiple threads simultaneously, allowing for parallel processing and improved performance.
• Mutex: A synchronization object that controls access to a shared resource, ensuring that only one thread can access the resource at a time.
• Namespace: A collection of identifiers (e.g. variable names, function names) that are used to organize code and prevent naming conflicts.
• National Institute of Standards and Technology (NIST): An agency of the US Department of Commerce that develops standards and guidelines, including for information security.
• Natural Language Processing: A field of AI that focuses on the interactions between computers and human languages, including speech recognition and generation, language translation and text understanding.
• Network Access Control (NAC): A security solution that controls and monitors network access, often based on device type, user credentials, and compliance status.
• Network security: The practice of protecting computer networks and data from unauthorized access and attacks.
• Network segmentation: The practice of dividing a network into smaller, isolated segments, often used to limit the scope of an attack and minimize the damage caused by a security breach.
• Network segmentation: The process of dividing a network into smaller, isolated segments, often used to limit the scope of an attack and minimize the damage caused by a security breach.
• Non-reentrant: A function that should not be called multiple times simultaneously, as it may cause unexpected behavior.
• Null: A special value that represents the absence of a value or object.
• Object: A programming construct that combines data and behavior.
• Overloading: The ability of a function or operator to behave differently depending on the number and/or type of its arguments.
• Overriding: The ability of a subclass to provide a new implementation of a method that is already provided by its superclass.
• OWASP: The Open Web Application Security Project, is a non-profit organization that provides resources and tools for improving web application security.
• Pair programming: A technique in which two programmers work on the same codebase at the same time, with one programmer writing code while the other reviews and provides feedback.
• Parallelism: The ability of a system to perform multiple tasks simultaneously using multiple processors or cores.
• PCI-DSS: Payment Card Industry Data Security Standards, a set of security standards created by major credit card companies to protect against credit card fraud.
• Penetration testing: A type of security testing that simulates a real-world attack on a system, often used to identify vulnerabilities and evaluate the effectiveness of security controls.
• Performance testing: The process of measuring the responsiveness, stability, and scalability of a system under different loads, often used to identify and fix performance bottlenecks and ensure that the system can handle expected usage patterns.
• Phishing: A type of social engineering attack that uses fraudulent emails or websites to trick victims into providing sensitive information or clicking on malicious links.
• Pointer: A variable that stores the memory address of another variable.
• Polymorphism: The ability of an object to take on many forms, often achieved through inheritance and interfaces.
• Privileged access management (PAM): The practice of controlling and monitoring access to sensitive systems and data by privileged users and applications.
• Public key cryptography: A type of cryptography that uses a pair of public and private keys to encrypt and decrypt data, often used for secure communication and digital signatures.
• Public Key Infrastructure (PKI): A set of policies, protocols, and technology used to create, manage, distribute, use, store and revoke digital certificates.
• Pure virtual function: A virtual function that has no implementation in the base class and must be implemented by a subclass.
• Quantum-safe cryptography: The practice of securing communications and data against the potential threats of quantum computing.
• Race condition: A condition where the behavior of a program depends on the order in which concurrent operations are executed, often causing unexpected or inconsistent results.
• Recursion: A technique in which a function calls itself, often used to solve problems that can be broken down into smaller, similar subproblems.
• Redundancy: The provision of additional resources or components to improve reliability and availability, often used in power, networking and storage systems.
• Reentrant: A function that can be safely called multiple times simultaneously without causing unexpected behavior.
• Reference: A type of pointer that creates an alias for a variable, allowing it to be accessed from multiple locations in the code.
• Reflection: The ability of a program to examine and manipulate its own structure, often used for introspection, serialization, and debugging.
• Risk assessment: The process of identifying and evaluating potential threats, vulnerabilities and impacts to an organization’s assets, and determining the likelihood of those risks occurring.
• Risk management: The process of identifying, evaluating, and mitigating risks to an organization’s IT resources and operations.
• Risk-based Authentication (RBA): The practice of using a risk-based approach to authentication, in which the level of authentication required is based on the risk level of the access request.
• Robotics: The branch of engineering that deals with the design, construction, operation, and use of robots.
• Rootkit: A type of malicious software that is designed to hide the presence of other malware on a system, allowing it to evade detection and maintain persistence.
• Sandboxing: A security technique that isolates potentially malicious code in a controlled environment to prevent it from causing harm.
• Sandboxing: A technique that isolates an untrusted application or code from the rest of the system, often used to prevent malicious code from accessing sensitive data and resources.
• Scope: The area of a program in which a variable or function can be accessed.
• Scrum: An Agile framework for managing and completing complex projects.
• Secure Sockets Layer (SSL): An older security protocol that provides privacy and data integrity between two communicating applications.
• Security Automation and Orchestration (SAO): The process of automating security tasks and workflows to improve efficiency and reduce human error.
• Security Compliance and Standards: The process of ensuring that an organization’s security practices align with industry standards and regulatory requirements such as PCI-DSS, HIPAA, and SOC2.
• Security Information and Event Management (SIEM): A security management system that collects and analyzes security-related data from various sources to detect and respond to security incidents.
• Security Operations Center (SOC): A centralized unit that is responsible for monitoring and analyzing security-related data, identifying and responding to security incidents, and implementing security controls.
• Security orchestration, Automation and Response (SOAR): The integration of security tools and processes to automate incident response and threat management.
• Security testing: The process of assessing the security of a system by attempting to identify and exploit vulnerabilities, often used to identify and fix security holes and ensure that the system can protect against malicious attacks.
• Security-as-a-Service (SaaS): A model in which security solutions and services are provided over the internet on a subscription basis.
• Semaphore: A synchronization object that controls access to a shared resource, allowing a certain number of threads to access the resource simultaneously.
• Serialization: The process of converting an object’s state to a format that can be stored or transmitted, often used for persistence, communication, and security.
• Serverless computing: An execution model in which the cloud provider is responsible for executing a piece of code by dynamically allocating the resources.
• Set: A collection of unique values, typically of the same data type.
• Single Sign-On (SSO): A mechanism that enables a user to authenticate once and gain access to multiple applications and systems.
• Smart Contract: A computer program that automatically executes the terms of a contract when certain conditions are met.
• SOC2: Service Organization Control 2, is a set of security standards created by the American Institute of Certified Public Accountants (AICPA) for service providers that handle sensitive customer data.
• Social engineering: The use of deception and manipulation to trick individuals into providing sensitive information or performing actions that compromise security.
• Software-Defined Perimeter (SDP): A security solution that uses software to create a secure and dynamic perimeter around an organization’s sensitive resources.
• Spam: Unwanted or unsolicited electronic messages, often sent in bulk, that are typically used for advertising or phishing.
• Spoofing: The practice of disguising oneself as another user or system in order to gain access or steal information.
• Stack: A memory area that stores temporary data, such as function call frames and local variables.
• Stress testing: The process of subjecting a system to increasingly heavy loads, often used to identify and fix performance bottlenecks and ensure that the system can handle unexpected usage patterns.
• String: A sequence of characters, often used to represent text.
• Supply Chain Attack: An attack that targets a third-party supplier or vendor in order to compromise the security of the main target.
• Supply chain security: The practice of ensuring the security of the components and services that are used to build and operate a system, including hardware, software and services from third-party vendors.
• Symmetric key cryptography: A type of cryptography that uses a single shared key to encrypt and decrypt data, often used for bulk encryption and secure key exchange.
• Systems security engineering: The practice of designing, developing and maintaining secure systems.
• Template: A feature in certain programming languages that allows a function or class to work with multiple types of data, rather than being tied to a specific type.
• Thread: A lightweight, independent unit of execution that can run concurrently with other threads.
• Threat hunting: The process of proactively searching for signs of malicious activity on a network or system that may have been missed by traditional security controls.
• Transport Layer Security (TLS): A security protocol that provides privacy and data integrity between two communicating applications.
• Tuple: An ordered collection of values, typically of different data types, stored in a single variable.
• Two-factor authentication: A security process that requires two forms of identification, often a password and a one-time code sent to a phone or email, in order to access an account or system.
• Type casting: The process of converting a value from one data type to another, either implicitly or explicitly.
• Type coercion: The process of converting a value from one data type to another, in a way that may not be immediately obvious or predictable.
• Unmarshalling: The process of converting a transmitted format back into an object’s state, often used to recreate an object from its marshalled form.
• usted by default and requires continuous authentication and authorization before granting access to resources.
• Variable: A named location in memory that stores a value.
• Virtual function: A function that is overridden by a subclass and can be called through a base class pointer or reference.
• Virtual Private Network (VPN): A technology that creates a secure, encrypted tunnel between two or more devices in order to protect communications from eavesdropping and tampering.
• Virtualization: The process of creating a virtual version of a physical resource, such as a server, storage device, or network, often used to improve resource utilization and flexibility.
• Vulnerability Management: The practice of identifying, assessing, and mitigating vulnerabilities in systems and networks.
• Vulnerability scanning: The process of automatically identifying potential vulnerabilities in a system, often used to identify and prioritize vulnerabilities for further testing and remediation.
• Web application security: The practice of securing web applications and APIs from design to deployment and ongoing maintenance.
• Zero trust network access (ZTNA): The practice of implementing a zero-trust security model for network access.
• Zero Trust: A security model that assumes that all users and devices are untr
• Zero-day exploit: An attack that takes advantage of a previously unknown vulnerability in a system or application, before the vendor or developer has had a chance to patch it.