TyscorpaExpanding the letters is the easy half. The column on the right is filled only where the expansion leaves you no wiser, or where a neighbouring acronym is routinely confused with this one.
Fundamentals and access
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| CIA | Confidentiality, Integrity, Availability | The three properties security exists to protect | The priority order is not fixed. Industrial and medical systems put availability and safety first, because a control that stops a physical process can be more dangerous than a disclosure. |
| AAA | Authentication, Authorization, Accounting | The three steps of every access decision | A sequence, not a list. Authentication asks who, authorisation asks what they may do per action, and accounting records what was done. Accounting is the one organisations under-implement and the one an investigation depends on. |
| MFA | Multi-Factor Authentication | Evidence from two different categories | A factor is a category, not an instance. Two passwords are one factor twice. The categories are something you know, something you have, something you are. |
| 2FA | Two-Factor Authentication | MFA with exactly two factors | |
| OTP | One-Time Password | A code valid for one authentication | Still phishable. A replica page can ask for the code and relay it inside its validity window, which is why hardware keys bound to the origin are stronger. |
| TOTP | Time-based One-Time Password | An OTP derived from a shared secret and the clock | Why an authenticator app works offline, and why clock drift breaks it. |
| HOTP | HMAC-based One-Time Password | An OTP derived from a shared secret and a counter | |
| SSO | Single Sign-On | One authentication granting access to many services | |
| ZT / ZTA | Zero Trust / Zero Trust Architecture | Trust nothing by location; verify every request | |
| PEP | Policy Enforcement Point | The component in the traffic path that allows or blocks | The only one of the zero trust components traffic actually passes through. It holds no policy and makes no decisions. |
| PDP | Policy Decision Point | The policy engine and administrator together | Decides but does not touch traffic. Compromising it means controlling access decisions everywhere, which is why it is protected as the most sensitive component. |
| PA | Policy Administrator | Establishes and tears down the session once a verdict exists | |
| PIN | Personal Identification Number | A short secret, almost always paired with something you hold | Knowledge, not possession. A PIN on its own is single-factor however short the number is. |
| SMS | Short Message Service | A one-time code delivered by text message | The weakest common second factor. Swapping the SIM moves the number to the attacker, and the code arrives at their handset instead. |
| CCTV | Closed-Circuit Television | Camera surveillance of a space | Detective when reviewed after the fact and deterrent when visible. It prevents nothing on its own, which is why it is paired with a physical barrier. |
Change management
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| CAB / CCB | Change Advisory Board / Change Control Board | The body that approves normal changes | Standard changes are pre-approved and skip it; emergency changes bypass the approval and not the documentation. |
| SOP | Standard Operating Procedure | How a recurring task is performed | What makes pre-approval defensible. A change can only be pre-approved if its risk is known, and its risk is only known if it is done the same way every time. |
| AUP | Acceptable Use Policy | What staff may and may not do with company systems | Managerial and directive. The acknowledgement is what makes it enforceable, not the publication. |
Cryptography
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| AES | Advanced Encryption Standard | The symmetric block cipher standard | The mode matters as much as the key. ECB encrypts identical blocks identically and leaks structure; GCM adds authentication so tampering is detected. |
| DES / 3DES | Data Encryption Standard | The symmetric cipher AES replaced | Retired. A 56-bit key is brute-forceable, and 3DES is deprecated rather than safe. |
| RSA | Rivest, Shamir, Adleman | Asymmetric algorithm based on factoring | One of the few acronyms that is a list of surnames. 2048 bits is the current minimum. |
| ECC | Elliptic Curve Cryptography | Asymmetric algorithms based on curves | Equivalent security at roughly a tenth the key length. A 256-bit curve key is comparable to 3072-bit RSA. |
| ECDSA | Elliptic Curve Digital Signature Algorithm | Signing with a curve key | |
| ECDH / ECDHE | Elliptic Curve Diffie-Hellman (Ephemeral) | Key exchange with a fresh key per session | The ephemeral part is what gives forward secrecy: a compromise of the long-term key does not expose sessions recorded earlier. |
| SHA | Secure Hash Algorithm | A family of cryptographic hash functions | SHA-1 is broken for collisions and retired for signatures. SHA-2 members are named for their output length; SHA-256 is the workhorse. |
| MD5 | Message Digest 5 | A 128-bit hash | Broken for any security purpose. Collisions can be produced deliberately and cheaply. |
| HMAC | Hash-based Message Authentication Code | A hash keyed with a shared secret | Gives integrity and authentication and not non-repudiation: both parties hold the same key, so neither can prove which of them produced it. That is the boundary between a MAC and a digital signature. |
| PBKDF2 | Password-Based Key Derivation Function 2 | A deliberately slow password hash | Stretching defeats brute force; salting defeats precomputation. Both are needed and neither substitutes. |
| TLS / SSL | Transport Layer Security / Secure Sockets Layer | Encryption for a connection | SSL is the retired predecessor and the name persists in conversation. TLS 1.2 and 1.3 are current. |
| TPM | Trusted Platform Module | A chip on the motherboard holding keys | What releases the disk encryption key only to a machine that boots unchanged. |
| HSM | Hardware Security Module | A tamper-responsive appliance holding keys | A TPM protects one machine; an HSM serves many and is certified to a standard such as FIPS 140. |
| KMS | Key Management Service | A managed service that creates, rotates and audits keys | |
| ECB | Electronic Codebook | The block cipher mode that encrypts each block independently | Identical plaintext blocks produce identical ciphertext, so structure survives encryption. The reason it is the wrong answer whenever a mode is being chosen. |
| CBC | Cipher Block Chaining | Each block is combined with the previous one before encryption | Hides the structure ECB leaks, and gives confidentiality only - nothing in it detects tampering. |
| GCM | Galois/Counter Mode | Encryption and an authentication tag in one operation | Authenticated encryption. Modified ciphertext fails the tag check rather than decrypting to plausible rubbish, which is why AES-GCM is what modern TLS negotiates. |
| PFS | Perfect Forward Secrecy | A session key that cannot be recovered from the long-term private key | What ephemeral key exchange buys. Traffic captured today stays unreadable even if the server key is stolen later. |
| DH | Diffie-Hellman | Agreeing on a shared secret over a channel anyone can read | Key exchange, not encryption and not signing. On its own it authenticates nobody, which is what makes an unauthenticated exchange interceptable. |
| DSA | Digital Signature Algorithm | Signing only, with no encryption capability | The contrast with RSA, which can do both. |
| PGP | Pretty Good Privacy | End-to-end encryption and signing, most often for mail and files | Trust comes from a web of trust rather than a certificate authority, which is the structural difference from PKI. |
| FDE | Full Disk Encryption | The whole volume encrypted at rest | Protects a device that is lost or stolen. Once the machine is booted and unlocked, it protects nothing from anybody using it. |
| FIPS | Federal Information Processing Standard | US standards for cryptographic modules and algorithms | FIPS 140 validation certifies the implementation, not just the algorithm. Correct maths in a flawed module still fails. |
| CTR | Counter Mode | A block cipher run as a stream cipher | Encrypts without padding, which removes a whole class of padding oracle attacks. GCM is this mode with authentication added. |
| RC4 | Rivest Cipher 4 | The stream cipher behind WEP and older TLS | Broken and removed everywhere. Seeing it named in an answer is usually the signal that the answer is the obsolete one. |
Public key infrastructure
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| PKI | Public Key Infrastructure | Everything built to answer whose public key this is | Public key cryptography works without it. What it cannot do alone is tell you whose key you hold, which is the entire problem PKI exists for. |
| CA | Certificate Authority | Validates identities and signs certificates | A compromised or careless CA can issue a valid certificate for any name, which has happened. Certificate transparency logs exist because of it. |
| RA | Registration Authority | Performs the identity checking on behalf of a CA | |
| CSR | Certificate Signing Request | The application for a certificate, carrying the public key | The private key never leaves the requester, which is the point. |
| CRL | Certificate Revocation List | A published list of certificates no longer trusted | |
| OCSP | Online Certificate Status Protocol | Checking one certificate rather than downloading a list | The weak point of PKI in practice: clients frequently fail open when the responder is unreachable, so revocation quietly does not happen. |