:PROPERTIES:
:ID:       258e3562-4311-4897-9a5c-1202311b14ae
:END:

#+title: just-talking/cyber-glossary
#+filetags: :project: :knowledge: :cybersecurity: :glossary:

MIGRATED 2026-10-06 to [[ot-ics-security-ramp/glossary]] (new project at ~/projects/tutorials/ot-ics-security-ramp). See there for current content; this node is kept only so old links/backlinks aren't dead ends.

** General Attack/Defense Vocabulary
- RAT (Remote Access Trojan) — malware giving an attacker remote hands-on-keyboard control of a victim machine.
- C2 (Command & Control) — the infrastructure/server an attacker uses to control compromised machines and receive stolen data. Distinguish from **C2 payload/C2 traffic**: the actual encoded command or data moving across that channel at a given moment — "C2" names the infrastructure, "C2 payload" names a specific piece of data on it.
- Web shell — malicious code (often a small script like PHP) dropped directly onto a compromised web server, giving the attacker remote command execution through the web server's own HTTP interface. Distinct from a RAT: no separate persistent connection needed, the "channel" is just HTTP requests to the already-compromised server. Header-based C2 smuggling (e.g. WHIPSHOT, a 2026-observed PHP web shell) hides Base64-encoded command/response data inside HTTP header values instead of the body/URL, since headers get less scrutiny from most traffic-inspection tools.
- IOC (Indicator of Compromise) — forensic evidence something already happened (bad hash, known-bad IP, dropped file). Reactive.
- IOA (Indicator of Attack) — behavioral signal an attack is happening right now, regardless of the specific malware (e.g. PowerShell spawned with an encoded command). Proactive/technique-based.
- Kill chain — the staged sequence of an attack (recon → exploit → install/persist → escalate privileges → move laterally → achieve objective).
- MITRE ATT&CK — a public catalogue/matrix of real-world adversary tactics and techniques, organized by attack-lifecycle stage; the industry's shared reference vocabulary for describing attacker behavior.
- Lateral movement — moving from an initially compromised host to other hosts within the network.
- Pivoting / SSH tunneling — using an already-compromised, dual-homed host as a relay to reach a network it can see but the attacker otherwise couldn't. Practically done via SSH port forwarding: `-L` forwards one local port to one specific internal target through the existing SSH session; `-D` opens a local SOCKS proxy so any tool's traffic gets relayed through that session. Chaining several compromised hosts this way (device A tunnels into network B, from which device C tunnels into network D...) is how a single credential compromise on the edge can reach deep into an otherwise-segmented internal network — the actual mechanism behind lateral movement, not just the goal.
- Living-off-the-land (LOTL) — using legitimate built-in OS tools (PowerShell, WMI, psexec) to carry out an attack instead of custom malware, to blend in and evade detection.
- Exfiltration — the act of stealing data out of a compromised network.
- Ransomware-as-a-Service (RaaS) — a ransomware operator provides the toolkit/infrastructure; affiliates carry out the actual intrusion and split the ransom revenue.
- Supply chain attack — compromising a trusted vendor/software update mechanism to reach that vendor's downstream customers.
- Zero-day — a vulnerability with no available patch (attacker often first to know). N-day — a known, patched vulnerability that's still exploitable wherever the patch hasn't been applied yet.
- APT (Advanced Persistent Threat) — a well-resourced, often nation-state-linked attacker group focused on long-term, stealthy access rather than smash-and-grab.
- TTP (Tactics, Techniques, and Procedures) — the standard way of describing *how* a specific threat actor operates, at three levels of specificity (tactic = goal, technique = general method, procedure = exact implementation). This is the language MITRE ATT&CK is built around.
- WAF (Web Application Firewall) — inspects/filters HTTP(S) requests against rules to block web-layer attacks.
- Sandboxing — running untrusted code in an isolated environment so it can't affect the surrounding system.
- Zero trust — never implicitly trust a device/user, even inside the "internal" network; always authenticate and authorize.
- SSO (Single Sign-On) — one login session grants access across multiple systems.
- MFA (Multi-Factor Authentication) — requiring more than one proof of identity to authenticate.
- SAML/OAuth — protocols for delegated authentication: a trusted identity source issues a token after authenticating the user, and that token is what other systems check instead of re-authenticating.
- Kerberoasting — requesting a Kerberos service ticket for a service account (any authenticated user can do this, no alert triggered), then cracking it offline to recover that account's password hash.
- CVE (Common Vulnerabilities and Exposures) — the standard ID assigned to a specific known vulnerability.
- CVSS (Common Vulnerability Scoring System) — the standard severity score (0-10) for a CVE.
- Red team / Blue team / Purple team — red = offense, simulates real attackers; blue = defense, detection & response; purple = collaboration between the two to improve detection.
- Pentest vs. vulnerability scan — a vuln scan is automated, passive, matches known signatures/CVEs; a pentest is human-driven, actively attempts real exploitation/chaining to validate actual risk.
- Port scanning — probing a range of IPs on a set of TCP/UDP ports to see which are open, as a quick way to fingerprint what services/devices are present without yet having to speak each protocol correctly (e.g. nmap). A scan that starts at a specific, already-known-valuable IP suggests prior reconnaissance; a scan hitting every address in a range sequentially suggests an untargeted automated sweep.
- Shodan — a search engine that continuously scans the entire public internet and indexes what it finds on open ports (banners, service metadata, sometimes screenshots), searchable by service type, port, geography, or organization. Unlike Google (indexes web page content), Shodan indexes *devices/services themselves* — webcams, routers, databases, and notoriously, internet-exposed ICS/SCADA devices (PLCs, HMIs) that were never meant to be reachable from the public internet. The standard first move in OT recon/research for finding exposed ICS protocols (Modbus/502, S7/102, DNP3/20000) in the wild — and the reason "don't scan real internet-facing ICS, keep it in your own lab" is a real ethical/legal line, not just caution for its own sake.
- CNA (CVE Numbering Authority) — an organization authorized to mint CVE IDs for a defined scope (its own products, a coordinator role, etc.). Most CVEs today are assigned by vendor CNAs or bug-bounty-platform CNAs (HackerOne, Bugcrowd), not by MITRE directly.
- CNA-LR (CNA of Last Resort) — MITRE's role: assigns CVE IDs via a request form when no vendor/coordinator CNA covers the affected product. Slower than going through a dedicated CNA.
- CERT/CC (CERT Coordination Center, Carnegie Mellon) — a third-party coordinator CNA, useful when a vendor is unresponsive, has no security contact, or an issue spans multiple vendors.
- CSIRT (Computer Security Incident Response Team) — generic term for an organizational incident-response team; CERT Polska carries out this function at Poland's national level (as "CSIRT NASK").
- PSIRT (Product Security Incident Response Team) — a vendor's internal team handling vulnerability reports and incident support for its own products; e.g. Siemens calls theirs "ProductCERT".
- Coordinated disclosure — reporting a vulnerability privately to the affected vendor first (rather than publishing immediately), giving them time to patch before any public CVE/details are released; the norm the whole CVE submission process assumes.
- CWE (Common Weakness Enumeration) — the taxonomy of vulnerability *types* (e.g. "CWE-79: Cross-Site Scripting"). A CVE identifies one specific instance of a flaw in a specific product; CWE classifies what *kind* of flaw it is.
- NVD (National Vulnerability Database) — NIST's database that enriches published CVEs with a CVSS score and structured metadata after a CNA assigns the ID.

** OT/ICS Fundamentals
- IT vs OT priority — IT security follows Confidentiality→Integrity→Availability (CIA); OT security flips it to Availability→Integrity→Confidentiality (AIC), because OT systems control physical processes where downtime/instability can cause physical harm.
- ICS (Industrial Control Systems) — umbrella term for equipment/software controlling physical industrial processes (PLCs, RTUs, HMIs, SCADA, DCS).
- SCADA (Supervisory Control and Data Acquisition) — a type of ICS focused on supervising geographically distributed systems (e.g. a utility grid or pipeline).
- DCS (Distributed Control System) — a type of ICS typically used within a single plant/site rather than spread over distance.
- PLC (Programmable Logic Controller) / RTU (Remote Terminal Unit) — the field-level controllers that read sensors and drive actuators in tight, fast loops (Purdue Level 1).
- HMI (Human-Machine Interface) — the operator-facing dashboard/screen showing live process data (Purdue Level 2).
- Historian — a database logging sensor/process data over time, typically at Purdue Level 3.
- Purdue Model — reference architecture mapping OT/IT network layers, Level 0 (physical sensors/actuators) up to Level 5 (corporate/enterprise); the IT/OT security boundary is conventionally drawn around Level 3/3.5.
- Level 3.5 / DMZ — the firewalled buffer zone mediating any traffic between OT (Levels 0-3) and IT (Levels 4-5); the main real-world security boundary in practice.
- Air-gapped — historically meant zero physical connectivity between OT and IT; in practice today almost nothing is truly air-gapped, so security work focuses on controlling the Level 3.5 boundary instead.
- Passive monitoring — watching a copy of network traffic (via a tap/span port) rather than actively scanning/injecting packets, because active scans can crash fragile field devices never built to handle unexpected input.
- Modbus — the oldest/most universal ICS protocol (1979); plaintext, no authentication; the canonical example of "ICS protocols have no security by design."
- DNP3 (Distributed Network Protocol) — dominant protocol for North American electric/water utility master-station-to-RTU communication; has an optional auth extension (DNP3-SA) rarely enabled in practice.
- IEC 61850 — modern substation automation standard for electric utilities; includes GOOSE messages.
- GOOSE (Generic Object Oriented Substation Event) — peer-to-peer protection-relay messages requiring single-digit-millisecond delivery, with essentially no authentication due to the speed requirement; a known attack surface (used in the 2016 Ukraine grid attack, Industroyer malware).
- IEC 60870-5-104 ("IEC 104") — DNP3's rough European/Middle-East equivalent protocol.
- OPC-UA — a newer IT/OT bridging protocol (e.g. historian-to-cloud) that, unlike the field-level protocols above, was built with authentication and encryption from the start.
- S7 — Siemens' proprietary ICS protocol for communicating with SIMATIC PLCs (S7-300/1200/1500 etc.), port 102/TCP; like Modbus/DNP3, a frequent target for ICS network scanning.
- CODESYS — the IEC 61131-3 engineering/runtime environment (port 11740/TCP) underlying many different vendors' PLCs, including WAGO's — a shared software base means a CODESYS vulnerability can cross vendor lines.
- VFD (Variable Frequency Drive) — a device that controls motor speed by varying the frequency/voltage of its power supply; common ICS target (pumps, fans, compressors) alongside PLCs.
- CHP (Combined Heat and Power) — a plant that generates electricity and useful heat from the same fuel source (cogeneration); a common critical-infrastructure target since it serves both the grid and district heating.
- DER (Distributed Energy Resources) — small-scale generation/storage assets connected to the distribution grid rather than centralized transmission-level generation (e.g. wind, solar, battery storage).
- DSO (Distribution System Operator) — the utility entity operating the local distribution grid (as distinct from a Transmission System Operator); DSOs typically run their own private telemetry networks reaching down to substations and RTUs.
- GCP (Grid Connection Point) — the point where a generation asset (e.g. a wind farm) connects into the distribution network and its operator. (Not to be confused with the identically-abbreviated Google Cloud Platform.)
- Private APN (Access Point Name) — a cellular-carrier-provisioned network, isolated from the public internet, used for machine-to-machine telemetry (e.g. DSO-to-RTU SCADA traffic). Often assumed "safe by isolation," but without client isolation between devices on the APN, one compromised device can reach every other device on it — treat it as untrusted as the public internet toward OT.

** OT/ICS Hands-On Lab Tools
Covered 2026-10-05 in response to "how do I build a fake OT network to play with" — see [[just-talking/cyber-terminology-ramp]] for progress tracking.
- pymodbus — Python library implementing a full Modbus TCP/RTU client and server; fastest way to stand up a fake "PLC" (a Modbus server with custom registers) in a few lines and point nmap/Wireshark at it.
- opendnp3 — open-source C++ DNP3 protocol stack (with Python bindings) for simulating a DNP3 master or outstation (DNP3's term for the field-device side); the DNP3 equivalent of pymodbus.
- OpenPLC — open-source IEC 61131-3 soft-PLC runtime: a real PLC, not just a protocol stub. Runs real ladder logic/structured text and serves it over genuine Modbus and DNP3 slave interfaces. Dockerized/Raspberry-Pi friendly; the accepted standard open-source PLC for ICS security training and CTFs.
- GRFICS (Graphical Realism Framework for Industrial Control Simulations) — Georgia Tech project providing a full prebuilt virtual plant (simulated chemical process + HMI + PLC logic + documented attack scenarios) as VMs, built explicitly for cybersecurity teaching/research. Closest thing to an "accepted standard" fake OT environment to attack.
- Conpot — low-interaction ICS honeypot, defaults to impersonating a Siemens S7-300 PLC; speaks Modbus, S7comm, BACnet, SNMP, HTTP simultaneously. Good for observing what scanning/exploitation traffic looks like against a fake device; not meant for realistic control logic.
- T-Pot — docker-compose bundle of Conpot plus a dozen other honeypots (IT + OT), with a Kibana dashboard of all captured attack traffic. Useful for the "SOC watching attacks land" view rather than the device-builder view.
- MiniCPS — Mininet-based framework for simulating networks of multiple PLCs/RTUs with physical process models; used in academic SWaT/WADI-style water-treatment-plant research. Heavier/academic, overkill unless specifically doing network-topology-level ICS research.
- ScadaBR — open-source HMI/SCADA software, commonly paired with OpenPLC to get a realistic-looking operator dashboard on top of real PLC logic.

** OT Attack Case Studies
- Stuxnet (2010) — malware delivered via USB to Iran's Natanz facility, targeted Siemens PLCs to physically destroy uranium centrifuges by subtly altering their speed, while feeding operators falsified "everything normal" readings. Canonical example of an OT *integrity* attack — not data theft, not an obvious outage, just making the physical process do the wrong thing while lying to the humans monitoring it. Widely attributed to a US/Israel joint operation, never officially confirmed.
- Ukraine grid attacks (2015, 2016) — first confirmed cyberattacks to cause a power outage. 2015: Sandworm (Russian GRU-linked) phished into utility IT, pivoted to OT, manually opened substation breakers via SCADA HMI (~230,000 people lost power). 2016: follow-up used Industroyer malware, the first malware built to natively speak ICS protocols (including IEC 61850 GOOSE) to automate breaker control at scale instead of manual HMI clicks.
- TRITON / TRISIS (2017) — targeted a Saudi petrochemical plant's Safety Instrumented System (SIS) — the independent emergency-shutdown layer that exists to prevent physical catastrophe (explosion, toxic release). Reprogrammed Schneider Electric SIS controllers; a bug in the attacker's own code accidentally triggered a shutdown, likely preventing serious harm. The case study proving OT attacks carry real physical/safety risk, not just theoretical danger.
- SIS (Safety Instrumented System) — an independent hardware/software layer that triggers automatic emergency shutdown if a process becomes physically dangerous, separate from the normal control system.
- Metcalf sniper attack (2013) — attackers shot up a PG&E transmission substation in California, knocking out 17 transformers. Physical, not cyber, but the case study behind NERC CIP-014 (mandating physical security planning for critical substations) — cited to make the point that critical-infrastructure risk isn't purely digital.
- Private-APN CHP plant incident (Poland, 29 Dec 2025; CERT Polska follow-up report) — attacker pivoted from a compromised wind-farm FortiGate VPN/firewall, through a Teltonika cellular router's SSH tunnel, across a DSO private APN lacking client isolation, into a WAGO PFC200 gateway PLC reachable via default web-admin credentials, then via a further SSH tunnel into an unrelated CHP plant's OT network — stopping Siemens S7-300/1200/1500 PLCs and shutting down a steam turbine and water treatment system. First known real-world attack to use a private APN as a lateral-movement path between otherwise-unconnected facilities; the attacker also destroyed the WAGO device's partition table as anti-forensics.

** OT Vendor Landscape
- Dragos — pure-play OT threat detection & intel vendor; known for naming/tracking specific ICS-targeting threat groups (e.g. XENOTIME, linked to TRITON), similar to how CrowdStrike names IT-side APT groups.
- Claroty — pure-play OT asset visibility + exposure/vulnerability management; also strong in healthcare device security under the term "xIoT" (extended IoT — medical devices, building systems, etc. alongside classic ICS).
- Nozomi Networks — pure-play OT asset visibility + passive network threat detection; notable distribution partnership with Palo Alto Networks.
- Dragos/Claroty/Nozomi are referred to as the OT security "big three" — all compete on roughly the same product shape: passive network monitoring → asset inventory → anomaly/threat detection → vulnerability/exposure management.
- Tenable.ot — Tenable's OT product (from acquiring Indegy), bundled with their IT vulnerability-management business.
- Microsoft Defender for IoT — Microsoft's OT offering (from acquiring CyberX).
- Forescout / Armis — broader IT/OT/IoT device-visibility vendors with Network Access Control (NAC) roots, less ICS-protocol-specialized than the big three.
- Vendor-native OT security — control-system manufacturers (Siemens, Schneider Electric, Honeywell) selling their own security add-ons for their own equipment.

** 2026 OT Threat Landscape & Supply-Chain Targets
(from the Dragos 2026 OT Cybersecurity Year in Review — see [[just-talking/cyber-reading-list]])
- KAMACITE, SYLVANITE, BAUXITE — named OT-targeting threat groups tracked by Dragos as active in 2026; BAUXITE notably deployed wiper malware alongside hacktivist messaging campaigns.
- MSP (Managed Service Provider) — a third party remotely managing IT/OT infrastructure (patching, monitoring, help desk) for multiple clients. A high-value supply-chain target because compromising one MSP can grant privileged access into all of its downstream clients at once (cf. the Kaseya ransomware incident).
- GIS (Geographic Information System) — software mapping/managing geospatial data. For utilities, GIS holds the physical topology (which pole feeds which transformer, pipeline routing, substation locations) — a reconnaissance goldmine for an attacker trying to map control loops and physical dependencies, which the 2026 Dragos report flagged as a rising adversary behavior.
- Engineering firms, system integrators, vendors, MSPs, and GIS providers are collectively the "trusted access periphery" around a utility — 2026 attacker focus has shifted toward this periphery rather than the utility's own network directly, since these firms hold privileged access or critical mapping data across multiple client environments.

** Compliance / Frameworks
- NERC (North American Electric Reliability Corporation) — the organization overseeing bulk power system reliability across North America.
- NERC CIP (Critical Infrastructure Protection) — NERC's mandatory, legally-enforced cybersecurity standards for the electric grid; not a voluntary best-practice framework like NIST CSF. Overseen/enforced by FERC, with fines up to $1M+/day per violation.
- FERC (Federal Energy Regulatory Commission) — the US federal regulator that oversees and enforces NERC standards.
- BES (Bulk Electric System) — the scope of NERC CIP: roughly the high-voltage transmission-level grid (generally 100kV+), not every piece of electric infrastructure. Small distribution-only utilities may fall outside CIP scope.
- NERC CIP is electric-sector only — water utilities fall under EPA/AWIA requirements instead, and gas pipelines under TSA security directives, not NERC CIP.
- CIP-002 — categorize BES Cyber Systems by impact (High/Medium/Low); the mandatory starting point for all other CIP standards.
- CIP-005 — Electronic Security Perimeter (ESP): the legal/compliance formalization of the Purdue Level-3.5 segmentation boundary.
- CIP-007 — system security management (patching, ports/services hardening), with the OT-specific tension that you can't patch live field devices the way you'd patch a laptop.
- CIP-008 — incident reporting and response planning requirements.
- CIP-010 — configuration change management and vulnerability assessments.
- CIP-013 — supply chain risk management (added ~2020): the standard legally requiring utilities to vet third-party/vendor/MSP access — directly related to the MSP/GIS supply-chain targeting trend above.
- CIP-014 — physical security requirements for critical substations, added in response to the 2013 Metcalf sniper attack.

** Networking / Crypto Primitives
- TLS (Transport Layer Security) — the standard encryption/authentication protocol behind HTTPS; assumes a reliable, ordered, connection-based transport (TCP).
- DTLS (Datagram Transport Layer Security) — TLS adapted to run over UDP instead of TCP, adding handshake retransmission and tolerance for packet loss/reordering/duplication since UDP gives none of that natively. Used wherever "HTTPS-grade" security is needed over a latency-sensitive, connectionless channel — VPN tunnel modes (e.g. Cisco AnyConnect), WebRTC, CoAP for constrained/IoT devices. Most classic field-level ICS protocols (Modbus, DNP3, GOOSE) predate DTLS and don't use it natively.
- VLAN (Virtual Local Area Network) — a logical, software-defined subdivision of a physical network, used to segment traffic without separate physical cabling; segmentation by VLAN alone doesn't stop an attacker who already has administrative access to a device that bridges multiple VLANs.
- SSH (Secure Shell) — encrypted remote shell/administration protocol; also commonly abused for tunneling (forwarding arbitrary traffic through an encrypted SSH session) to pivot across network boundaries.
- RDP (Remote Desktop Protocol) — Microsoft's protocol for remote GUI access to Windows machines; a frequent lateral-movement and credential-brute-force target.
- VNC (Virtual Network Computing) — a platform-independent remote-desktop protocol; like RDP, a common target for credential-guessing during network reconnaissance.
- RTSP (Real Time Streaming Protocol) — protocol for controlling streaming media sessions, commonly used by IP video-surveillance/CCTV systems.
- Client isolation — a network configuration that prevents devices on the same subnet/segment (e.g. the same private APN or Wi-Fi AP) from communicating directly with each other, typically restricting them to talk only to a gateway. Its absence was the root misconfiguration that let an attacker pivot across devices sharing a DSO private APN in the CERT Polska December 2025 incident.
- VPN concentrator — a dedicated device (often combined with a firewall) built to terminate and manage many simultaneous VPN tunnels at once, from many remote clients/sites, as opposed to being a single tunnel's endpoint like client VPN software. A single compromised concentrator can expose every site/segment it serves — as with the FortiGate device in the CERT Polska December 2025 incident.
- ICT (Information and Communication Technology) — a broader-scope synonym for "IT," more common in European/telecom/utility usage, covering computing and communications infrastructure together. In utility contexts, "the DSO's ICT network" means the DSO's own IT/corporate-side systems, as distinct from the OT side (RTUs, field devices) — functionally the same split the Purdue Level 3.5 DMZ formalizes.