TyscorpaThis domain carries more acronyms than any other, and most of them name a box or a service. The fourth column is used mainly to separate the ones that sound interchangeable and are not.
Cloud and compute models
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| IaaS | Infrastructure as a Service | Virtual machines, storage and networking you manage | The customer patches the guest operating system. This is the most consequential line in the shared responsibility model and the one most often assumed away. |
| PaaS | Platform as a Service | The provider runs the OS and runtime; you deploy code | |
| SaaS | Software as a Service | The provider runs everything; you configure it and own the data | The data is yours in every model. No provider ever takes on classifying it or deciding who may see it. |
| FaaS | Function as a Service | Serverless - code runs on demand with no instance to manage | Serverless does not mean no servers. It means none you manage, and the risk moves to the permissions each function holds. |
| IaC | Infrastructure as Code | Infrastructure defined in files rather than built by hand | A mistake in the definition is applied everywhere at once, and a secret committed to the repository is the commonest serious finding. |
| VDI | Virtual Desktop Infrastructure | Desktops hosted centrally and streamed to thin clients | |
| SDN | Software-Defined Networking | The control plane separated from the data plane | Policy is expressed once centrally rather than device by device, which also makes the controller a concentration of risk. |
Network structure
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| VLAN | Virtual Local Area Network | Logical segments on shared physical infrastructure | Separates broadcast domains and is not access control. Routed with a permissive rule set, hosts reach each other as freely as before with one extra hop. |
| DMZ | Demilitarized Zone | A segment for the systems the internet must reach | Also called a screened subnet. The inner policy is the whole design: a compromised web server should yield a segment of other exposed systems and a very short list of paths inward. |
| NAT | Network Address Translation | Rewriting addresses at the boundary | Built to solve address exhaustion. Its security effect is a side effect, and it is not a firewall: it applies no policy and inspects nothing. |
| CDN | Content Delivery Network | Distributed caching close to users | Absorbs volumetric denial of service upstream, which is why it appears as a mitigation and not only as a performance measure. |
| LAN / WAN | Local / Wide Area Network | One site, and the links between sites | |
| SAN | Storage Area Network | Block storage presented over a dedicated network | Also the abbreviation for a Subject Alternative Name in a certificate. Unrelated, and both appear in this syllabus. |
| NAS | Network Attached Storage | File storage shared over the ordinary network | |
| SPAN | Switched Port Analyzer | A switch port that receives a copy of other ports' traffic | How an IDS is fed. A copy arrives after the fact, which is exactly why a device on a SPAN port cannot block anything. |
| CAM | Content Addressable Memory | The table mapping MAC addresses to switch ports | Flooding it past capacity makes the switch broadcast to every port, turning a switched network back into a hub for the attacker. |
| DAI | Dynamic ARP Inspection | Dropping ARP replies that contradict the DHCP bindings | The switch-level answer to ARP poisoning. |
| DTP | Dynamic Trunking Protocol | Automatic negotiation of a trunk link | Left enabled on an access port, a host can negotiate a trunk and reach every VLAN. Disabling it is the standard hardening step. |
| SWG | Secure Web Gateway | Outbound web filtering and inspection |
Protocols, and the ports they answer on
Port numbers are asked about directly, and the pattern worth holding is the pairing: nearly every one of these has a clear-text original and a protected replacement.
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| TCP / UDP | Transmission Control Protocol / User Datagram Protocol | Connected and connectionless transport | UDP has no handshake, so the source address is trivially forged. That is what makes UDP services the ones used for reflection and amplification. |
| IP | Internet Protocol | Addressing and routing between networks | |
| ICMP | Internet Control Message Protocol | Reachability and error messages, including ping | Has no ports. Blocking it wholesale breaks path MTU discovery and is a common cause of connections that hang rather than fail. |
| DNS | Domain Name System | Names resolved to addresses, on port 53 | Answers are not authenticated by default, which is what poisoning exploits. It is also the commonest covert channel out of a network, because it is almost never blocked. |
| DNSSEC | Domain Name System Security Extensions | Signed DNS records | Provides origin authentication and integrity, and not confidentiality - the answers remain in clear text. DoH and DoT are what encrypt them. |
| DHCP | Dynamic Host Configuration Protocol | Automatic address assignment, on ports 67 and 68 | A rogue server wins by answering first, and hands out its own address as the gateway. |
| NTP | Network Time Protocol | Clock synchronisation, on port 123 | Correlation across logs and certificate validity both depend on it. A drifting clock quietly breaks the evidence. |
| HTTP / HTTPS | Hypertext Transfer Protocol (Secure) | The web, on ports 80 and 443 | 443 is where almost everything now hides, which is why port-based filtering has stopped telling you anything. |
| SSH | Secure Shell | Encrypted remote administration, on port 22 | Key-based authentication is the point. An orphaned authorised key is an account nobody reviews and nobody disables. |
| FTP / FTPS / SFTP | File Transfer Protocol, over TLS, over SSH | Ports 20 and 21, then 990, then 22 | FTPS is FTP wrapped in TLS; SFTP is a different protocol carried by SSH. They share three letters and nothing else. |
| SCP | Secure Copy Protocol | File copy over SSH, on port 22 | |
| TFTP | Trivial File Transfer Protocol | Minimal UDP file transfer, on port 69 | No authentication at all. Present on network gear for config and firmware, and worth finding before somebody else does. |
| SMTP | Simple Mail Transfer Protocol | Mail delivery, on port 25, submission on 587 | The envelope sender is asserted by whoever connects, which is the whole reason SPF, DKIM and DMARC exist. |
| IMAP / POP3 | Internet Message Access Protocol / Post Office Protocol 3 | Mail retrieval, on 143 and 110, or 993 and 995 over TLS | Legacy mail protocols cannot carry a second factor, so leaving them enabled leaves a way past MFA. |
| SMB | Server Message Block | Windows file and printer sharing, on port 445 | The path lateral movement uses most, and a port that should never be reachable from outside. |
| RDP | Remote Desktop Protocol | Windows graphical remote access, on port 3389 | Exposed to the internet it is a standing invitation, and the way a great many ransomware incidents began. |
| VNC | Virtual Network Computing | Cross-platform graphical remote access, on port 5900 | |
| L2TP | Layer 2 Tunneling Protocol | Tunnelling with no encryption of its own | Always paired with IPsec, because on its own it protects nothing. |
| BGP | Border Gateway Protocol | Routing between autonomous systems on the internet | Built on trust between operators. A hijacked prefix redirects traffic for entire networks with nothing broken anywhere. |
| OSI | Open Systems Interconnection | The seven-layer reference model | Its use here is to say what a control can see. A layer 3 rule cannot read a URL, and a layer 7 proxy can. |
| TTL | Time To Live | A hop limit on a packet, and a cache lifetime on a DNS record | A very short record TTL is normal for failover and is also how fast-flux hosting keeps moving. |
Appliances and inspection
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| IDS / NIDS | (Network) Intrusion Detection System | Observes a copy of the traffic and alerts | Cannot block. The packets it examined have already been delivered. |
| IPS | Intrusion Prevention System | Sits inline and can drop traffic | A false positive is an outage rather than a wasted alert, which is why blocking is usually enabled only for high-confidence signatures. |
| WAF | Web Application Firewall | Inspects the HTTP conversation itself | Layer 7. A traditional firewall sees HTTPS to port 443 and permits the injection along with it. |
| NGFW | Next-Generation Firewall | A firewall with deep packet inspection and application awareness | Identifies the application regardless of port, which matters because everything now tunnels over 443. |
| UTM | Unified Threat Management | Several security functions in one appliance | Convenient for a small site and a single point of failure for the same reason. |
| CASB | Cloud Access Security Broker | Policy enforcement between users and cloud services | Where sanctioned and unsanctioned cloud use becomes visible, which is the first step against shadow IT. |
| NAC | Network Access Control | Deciding what a device may do when it connects | Posture checking happens here: patch level and agent presence decide the segment, not just the credential. |
| SASE | Secure Access Service Edge | Network and security functions delivered from the cloud | The answer when the users and the applications are both outside the office, and backhauling to an appliance no longer makes sense. |
| SD-WAN | Software-Defined Wide Area Network | Policy-driven routing across several links | |
| ZTNA | Zero Trust Network Access | Access to one application rather than to a network | Replaces the VPN model. The application is never exposed, so there is no listening service to find and no lateral movement from a foothold. |
| SDP | Software-Defined Perimeter | The same architecture as ZTNA under another name | Recognising them as the same thing is more useful than separating them. |
Tunnels and transport
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| VPN | Virtual Private Network | A protected connection over shared infrastructure | Protects traffic in transit and says nothing about the security of either endpoint. Split tunnelling is the configuration decision the exam returns to. |
| IPsec | Internet Protocol Security | Protection applied at layer 3 | Covers everything above it without applications knowing, which is why it suits site-to-site links. |
| AH | Authentication Header | IPsec integrity and authentication, with no encryption | Largely historical, partly because it breaks with address translation. |
| ESP | Encapsulating Security Payload | IPsec with encryption | What is actually deployed. |
| IKE | Internet Key Exchange | Negotiates the IPsec keys and parameters | |
| SNI | Server Name Indication | The hostname sent in clear text so one address can serve many sites | Encrypted traffic still says where it is going. Useful for filtering without decryption, and a privacy leak for the same reason. |
Wireless
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| SSID | Service Set Identifier | The name of a wireless network | Not a security control. Disabling the broadcast hides nothing, because the name travels in the frames clients send anyway. |
| WAP / AP | (Wireless) Access Point | The radio clients associate with | One SSID is usually served by many of them, so the rogue is identified by its BSSID rather than by the network name. |
| WPA2 / WPA3 | Wi-Fi Protected Access 2 / 3 | The current wireless security standards | WPA2 uses AES-CCMP, not RC4 - RC4 belongs to WEP and to the original WPA. WPA3 replaces the handshake rather than the cipher. |
| SAE | Simultaneous Authentication of Equals | The WPA3 handshake | Resists the offline attack that made a captured WPA2 handshake worth having. |
| EAP | Extensible Authentication Protocol | The framework enterprise wireless authenticates through | |
| RADIUS | Remote Authentication Dial-In User Service | The AAA server enterprise wireless authenticates against | What gives each user their own identity, so access can be granted, logged and withdrawn one person at a time. |
| TACACS+ | Terminal Access Controller Access-Control System Plus | AAA for administrative access to network devices | Separates the three A functions more completely than RADIUS does, and can authorise individual commands. |
| WEP | Wired Equivalent Privacy | The original wireless encryption, broken beyond repair | The flaw is in how it uses RC4's initialisation vector, so the key falls out of enough captured traffic. Finding it in use is a finding on its own. |
| WPA | Wi-Fi Protected Access | The stopgap between WEP and WPA2 | Kept RC4 and added TKIP, so it ran on WEP-era hardware. Also obsolete. |
| TKIP | Temporal Key Integrity Protocol | Per-packet keying bolted onto WEP-era hardware | |
| CCMP | Counter Mode with CBC-MAC Protocol | The AES-based protocol WPA2 actually encrypts with | What people mean when they say WPA2 uses AES. |
| OWE | Opportunistic Wireless Encryption | Encryption on an open network with no password | Solves the guest and coffee-shop case, where the alternative is every association in clear text. |
| PMF | Protected Management Frames | Authentication of management frames | Stops the deauthentication attack, which works because those frames were never authenticated. Mandatory in WPA3. |
| PEAP | Protected Extensible Authentication Protocol | EAP inside a TLS tunnel | The tunnel only helps if the client validates the server certificate. Without that check it authenticates to whichever radio answers. |
| BSSID | Basic Service Set Identifier | The MAC address of the individual radio | Several access points share one SSID, so the BSSID is what identifies the rogue among them. |
| MAB | MAC Authentication Bypass | Admitting a device by its hardware address when it cannot do 802.1X | For printers and cameras. The address is trivially spoofed, so it is a concession rather than a control. |
Specialised platforms and resilience
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| ICS | Industrial Control System | Systems controlling a physical process | Availability and safety come before confidentiality, which inverts the usual priority order. |
| SCADA | Supervisory Control and Data Acquisition | The supervisory layer above industrial controllers | Protocols with no authentication, designed for isolated networks that are no longer isolated. |
| RTOS | Real-Time Operating System | An operating system that guarantees when something happens | Determinism, not speed. Anything that adds variable delay - an agent, inline inspection - is unacceptable. |
| IoT | Internet of Things | Connected devices built to a price | Default credentials, no update mechanism and no inventory. What the largest botnets were assembled from. |
| TEE | Trusted Execution Environment | A processor region nothing outside it can read, such as Intel SGX | How data in use is protected - not by the operating system, the hypervisor or an administrator. |
| HA | High Availability | Design that survives a component failure without an outage | Availability, not recovery. Clustering and load balancing serve it; backups do not. |
| RAID | Redundant Array of Independent Disks | Redundancy across disks | Not a backup. It holds one version of the data, so deletion, corruption and encryption all pass straight through it. |
| UEFI | Unified Extensible Firmware Interface | The firmware layer that replaced the BIOS | Where Secure Boot lives, and where a bootkit sits below anything the operating system can inspect. |
| UPS | Uninterruptible Power Supply | Battery cover for a short outage | Buys minutes, for a clean shutdown or until the generator starts. A generator covers the long outage; neither covers both. |
| HVAC | Heating, Ventilation and Air Conditioning | Environmental control for the facility | An availability control, and repeatedly the way into a network it had no business being connected to. |
| WORM | Write Once, Read Many | Storage that cannot be altered after writing | What makes a backup or a log survive an administrator - and therefore ransomware, which uses administrator rights to destroy the copies first. |
| TEMPEST | A US programme name, not an expansion | Shielding against information leaking as electromagnetic emanation | The countermeasure to reading a screen or a cable from outside the room. Belongs with air gaps and Faraday cages at the top of the sensitivity scale. |