TyscorpaMost of these name a product category, and several pairs get confused because the products themselves overlap. The fourth column separates the ones the exam tests against each other.
Endpoints and mobile
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| EDR | Endpoint Detection and Response | Behavioural detection and response on the endpoint | Watches what code does rather than what it looks like, which is what catches fileless malware and living-off-the-land activity. |
| XDR | Extended Detection and Response | EDR correlated across endpoint, network, mail and cloud | |
| HIDS / HIPS | Host-based Intrusion Detection / Prevention System | The same detect-or-block distinction, on one machine | Sees what the network never does, including activity that never leaves the host and traffic that is encrypted end to end. |
| MDM | Mobile Device Management | Central management of mobile devices | Matters more than network controls for phones, because a cellular connection bypasses the perimeter entirely. |
| BYOD | Bring Your Own Device | The employee owns the device | Every control is negotiated against the fact that it is somebody else's property, which is what containerisation exists to resolve. |
| COPE | Corporate-Owned, Personally Enabled | The organisation owns it and permits personal use | |
| CYOD | Choose Your Own Device | The employee picks from an approved list the organisation owns |
Vulnerability management
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| CVE | Common Vulnerabilities and Exposures | A unique identifier for a known vulnerability | An identifier and nothing more. It carries no severity, no exploitability and no deadline, so asking how bad a CVE is has no answer from the number itself. |
| CVSS | Common Vulnerability Scoring System | A 0-10 severity score | Published scores are usually base metrics only, describing a worst case rather than your case. The environmental metrics are what express what the system is worth here. |
| NVD | National Vulnerability Database | CVE entries enriched with scores and references | |
| KEV | Known Exploited Vulnerabilities | A catalogue of vulnerabilities being exploited in the wild | Often a better guide to urgency than the score, because it describes what is happening rather than what could. |
| SAST | Static Application Security Testing | Analysing source code without running it | Finds the flaw before the code ships and cannot tell whether the path is reachable, which is where its false positives come from. |
| DAST | Dynamic Application Security Testing | Testing the application while it runs | Sees the deployed configuration and the flaws that only exist once the parts are assembled. |
| OSINT | Open Source Intelligence | Intelligence gathered from publicly available sources | Open means publicly available, not open-source software. It is passive, so nothing reaches the target and nothing is logged. |
| SCAP | Security Content Automation Protocol | A standard for expressing and checking configuration | What lets one benchmark be evaluated by tools from different vendors and produce the same answer. |
Monitoring and response
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| SIEM | Security Information and Event Management | Central collection, correlation and alerting on logs | The value is in the correlation, not the storage. An intrusion is visible in the sequence across sources, and no single system holds that sequence. |
| SOC | Security Operations Center | The people and process who watch and respond | Collides with SOC 2, which is an audit report and unrelated. Which one is meant comes from the surrounding words. |
| SOAR | Security Orchestration, Automation and Response | Playbooks that act across integrated tools | Adds automated response to what a SIEM detects. Its stored credentials make it one of the highest-value targets in the estate. |
| DLP | Data Loss Prevention | Detecting and blocking sensitive data on its way out | A control against accident and the untrained. Splitting, encoding or archiving a value defeats it, so it will not stop a determined insider. |
| FIM | File Integrity Monitoring | Alerting when files that should not change do | Catches persistence whether or not anything recognises the file that was planted. |
| UEBA / UBA | User (and Entity) Behavior Analytics | Alerting on departures from a learned baseline | The entity half matters because much of an intrusion is machine behaviour. Its weakness is that an intrusion present while the baseline was learned gets baselined as normal. |
| SNMP | Simple Network Management Protocol | Device state and traps from network equipment | Version 3 is the one with authentication and encryption; the earlier versions send a community string in clear text. |
| IR | Incident Response | Preparation, detection, analysis, containment, eradication, recovery, lessons learned | Containment comes before eradication. Removing the malware first destroys the evidence and usually misses how it arrived. |
| RCA | Root Cause Analysis | Establishing why it was possible, not what was done | |
| CoC | Chain of Custody | The unbroken record of who held evidence and when | What makes evidence admissible. A gap in it is not a paperwork problem. |
| CMDB | Configuration Management Database | The record of what exists and how the pieces depend on each other | Vulnerability management, change management and incident response all fail the same way when it is wrong - on the assets nobody recorded. |
| PICERL | Preparation, Identification, Containment, Eradication, Recovery, Lessons learned | The incident response phases as a mnemonic | Containment sits before eradication deliberately. Cleaning first destroys the evidence and usually misses the way in. |
| FTK | Forensic Toolkit | A forensic acquisition and analysis suite | Named alongside dd and Autopsy. What matters is the write blocker and the hash, not the brand. |
| ESI | Electronically Stored Information | The data a legal hold applies to | A hold suspends deletion, so retention schedules and automatic purges have to be stopped. Continuing to delete on schedule is spoliation. |
| UTC | Coordinated Universal Time | The single timezone logs are normalised to | Correlating sources across regions is impossible without it, and a timeline assembled from local timestamps is wrong in a way that is hard to see. |
Access control models
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| RBAC | Role-Based Access Control | Rights attach to a role, and people are put into roles | What makes a move between departments a change of role rather than an addition to it. Rights that accumulate instead are privilege creep. |
| ABAC | Attribute-Based Access Control | The decision is computed from attributes at request time | Handles conditions a role cannot express - this device, this location, this hour - which is what conditional access is built on. |
| DAC | Discretionary Access Control | The owner of a resource decides who may use it | What ordinary file permissions are. Flexible, and impossible to hold to a policy centrally. |
| MAC | Mandatory Access Control | The system enforces labels and no owner may override them | Classification levels and clearances - the strictest model and the least flexible. Three unrelated things in this syllabus share these letters: this, Media Access Control (a hardware address) and Message Authentication Code (a keyed integrity check). Only the surrounding sentence separates them. |
Identity and access
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| IAM | Identity and Access Management | The whole discipline of who may do what | |
| PAM | Privileged Access Management | Vaulting, just-in-time rights and ephemeral credentials | Restores attribution to a shared account that a system requires and cannot be made individual. |
| LDAP / LDAPS | Lightweight Directory Access Protocol (Secure) | Querying a directory, without and with TLS | A query protocol. Nothing in it tells an application that a person was hired or dismissed. |
| SAML | Security Assertion Markup Language | Asserting who a user is, for single sign-on | Authentication. OAuth is delegated authorisation, and confusing the two is the standard error. |
| OAuth | Open Authorization | Granting an application limited access on your behalf | Does not authenticate on its own. OpenID Connect is the identity layer that adds that. |
| OIDC | OpenID Connect | An identity layer on top of OAuth | |
| SCIM | System for Cross-domain Identity Management | Pushing account creation, change and deactivation between systems | The provisioning answer, and its value is the leaver case: access ends without anybody raising a ticket. |
| JIT | Just-In-Time | Rights granted for a bounded period on request | An account holding permanent administrative rights is worth stealing at any hour; one holding none usually yields nothing. |
| FIDO2 | Fast Identity Online 2 | The standard behind hardware security keys and passkeys | Phishing-resistant because the credential is bound to the origin and will not be offered to a replica site. |
| AD | Active Directory | The Windows directory and authentication service | Compromising it is compromising the estate, which is why domain controllers are treated as a tier of their own. |
| KDC | Key Distribution Center | The Kerberos service that issues tickets | |
| TGT | Ticket Granting Ticket | The ticket proving you authenticated, used to request others | A stolen TGT is usable without the password, which is why pass-the-ticket survives a password reset. |
| TGS | Ticket Granting Service | Issues service tickets against a TGT | Kerberoasting requests one for a service account and cracks it offline, because the ticket is encrypted with that account's password hash. |
| KRBTGT | Kerberos Ticket Granting Ticket account | The account whose key signs every ticket in the domain | Its hash forges a golden ticket. Recovering from that theft means resetting it twice, and nothing less works. |
| NTLM | NT LAN Manager | The legacy Windows authentication protocol | What makes pass-the-hash possible, since the hash is the credential. Kerberos replaced it and it stays enabled for compatibility. |
| PIV | Personal Identity Verification | A smart card holding a certificate and requiring a PIN | Two factors in one object - the card and the PIN - which is why it is not single-factor despite being one item. |
| IGA | Identity Governance and Administration | Certification campaigns, entitlement review and segregation-of-duties checks | Answers who should have this, where IAM answers who does. Attestation lives here. |
| JML | Joiner, Mover, Leaver | The identity lifecycle | Mover is the one that leaks. Joining and leaving are noticed; a transfer that adds rights without removing any is not. |
| PAW | Privileged Access Workstation | A hardened machine used only for administration | Keeps mail and browsing off the machine that holds domain credentials, which is where those credentials are usually stolen from. |
| FAR | False Acceptance Rate | How often the wrong person is admitted | The security failure. Tightening the sensor lowers it and raises the FRR - the two always move against each other. |
| FRR | False Rejection Rate | How often the right person is refused | The usability failure, and the one that drives people to work around the control. |
| CER / EER | Crossover / Equal Error Rate | The sensitivity at which FAR and FRR are equal | The single figure biometric systems are compared by. Lower is better. |
Mail and web hardening
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| SPF | Sender Policy Framework | A DNS record listing who may send for the domain | Checks the envelope sender, which the recipient never sees. That gap is why it fails alone. |
| DKIM | DomainKeys Identified Mail | A signature over the message, verified against a published key | Survives forwarding in a way SPF does not, because it travels with the message. |
| DMARC | Domain-based Message Authentication, Reporting and Conformance | What to do when SPF or DKIM fails, and where to report it | The one that closes the gap: it requires alignment with the visible From address, and it is the only one of the three that tells the recipient to reject. |
| S/MIME | Secure/Multipurpose Internet Mail Extensions | End-to-end signing and encryption of the message itself | Protects content from the mail servers too, where the three records above only authenticate the sending domain. |
| STARTTLS | Start Transport Layer Security | Upgrading an existing clear-text session to TLS | Opportunistic. An attacker in the path can strip the offer and the session continues unencrypted, which is what MTA-STS exists to prevent. |
| HSTS | HTTP Strict Transport Security | A header instructing the browser never to use plain HTTP again | Closes the redirect window a downgrade attack uses, but only after one successful visit unless the domain is preloaded. |
| STIG | Security Technical Implementation Guide | DISA's hardening specifications for a platform | |
| CIS | Center for Internet Security | Publishes the Benchmarks and the Critical Security Controls | Benchmarks harden a platform; the Controls prioritise a programme. Two different documents from one body. |
| NGAV | Next-Generation Antivirus | Malware prevention driven by behaviour and machine learning | Prevention, where EDR is detection and investigation. Products usually sell both together. |
Automation
| Acronym | Expands to | What it is | Worth knowing |
|---|---|---|---|
| API | Application Programming Interface | How automation talks to the systems it orchestrates | Each integration is a credential, and together they can exceed the authority of any human administrator. |
| CI/CD | Continuous Integration / Continuous Deployment | Automated build, test and release | A security check in the pipeline finds the defect while the author still has the context and nothing is exposed yet. |
| SDLC | Software Development Life Cycle | Requirements through design, build, test, release and maintenance | Security requirements set at the requirements stage cost a fraction of the same fix found in production. |
| REST | Representational State Transfer | The style most web APIs are built in | Stateless, so every request carries its own credential - which is why a leaked token is usable immediately and from anywhere. |
| JSON | JavaScript Object Notation | The format most APIs exchange data in | |
| XML | Extensible Markup Language | The format SAML assertions and older APIs use | Its external entity feature is what XXE abuses, which is why parsers are configured to refuse them. |