roam/just-talkingcyber-glossary.org

just-talking/cyber-glossary

• General Attack/Defense Vocabulary
• OT/ICS Fundamentals
• OT Attack Case Studies
• OT Vendor Landscape
• 2026 OT Threat Landscape & Supply-Chain Targets
• Compliance / Frameworks
• Networking / Crypto Primitives

Running, quiz-ready glossary built up during Aner's cybersecurity terminology ramp-up (see just-talking/cyber-terminology-ramp for the study plan/methodology this supports). Term → one-line definition. Updated automatically as new terms are covered in session, no need to ask first.

General Attack/Defense Vocabulary

• RAT (Remote Access Trojan) — malware giving an attacker remote hands-on-keyboard control of a victim machine.
• C2 (Command & Control) — the infrastructure/server an attacker uses to control compromised machines and receive stolen data. Distinguish from C2 payload/C2 traffic: the actual encoded command or data moving across that channel at a given moment — "C2" names the infrastructure, "C2 payload" names a specific piece of data on it.
• Web shell — malicious code (often a small script like PHP) dropped directly onto a compromised web server, giving the attacker remote command execution through the web server's own HTTP interface. Distinct from a RAT: no separate persistent connection needed, the "channel" is just HTTP requests to the already-compromised server. Header-based C2 smuggling (e.g. WHIPSHOT, a 2026-observed PHP web shell) hides Base64-encoded command/response data inside HTTP header values instead of the body/URL, since headers get less scrutiny from most traffic-inspection tools.
• IOC (Indicator of Compromise) — forensic evidence something already happened (bad hash, known-bad IP, dropped file). Reactive.
• IOA (Indicator of Attack) — behavioral signal an attack is happening right now, regardless of the specific malware (e.g. PowerShell spawned with an encoded command). Proactive/technique-based.
• Kill chain — the staged sequence of an attack (recon → exploit → install/persist → escalate privileges → move laterally → achieve objective).
• MITRE ATT&CK — a public catalogue/matrix of real-world adversary tactics and techniques, organized by attack-lifecycle stage; the industry's shared reference vocabulary for describing attacker behavior.
• Lateral movement — moving from an initially compromised host to other hosts within the network.
• Living-off-the-land (LOTL) — using legitimate built-in OS tools (PowerShell, WMI, psexec) to carry out an attack instead of custom malware, to blend in and evade detection.
• Exfiltration — the act of stealing data out of a compromised network.
• Ransomware-as-a-Service (RaaS) — a ransomware operator provides the toolkit/infrastructure; affiliates carry out the actual intrusion and split the ransom revenue.
• Supply chain attack — compromising a trusted vendor/software update mechanism to reach that vendor's downstream customers.
• Zero-day — a vulnerability with no available patch (attacker often first to know). N-day — a known, patched vulnerability that's still exploitable wherever the patch hasn't been applied yet.
• APT (Advanced Persistent Threat) — a well-resourced, often nation-state-linked attacker group focused on long-term, stealthy access rather than smash-and-grab.
• TTP (Tactics, Techniques, and Procedures) — the standard way of describing how a specific threat actor operates, at three levels of specificity (tactic = goal, technique = general method, procedure = exact implementation). This is the language MITRE ATT&CK is built around.
• WAF (Web Application Firewall) — inspects/filters HTTP(S) requests against rules to block web-layer attacks.
• Sandboxing — running untrusted code in an isolated environment so it can't affect the surrounding system.
• Zero trust — never implicitly trust a device/user, even inside the "internal" network; always authenticate and authorize.
• SSO (Single Sign-On) — one login session grants access across multiple systems.
• MFA (Multi-Factor Authentication) — requiring more than one proof of identity to authenticate.
• SAML/OAuth — protocols for delegated authentication: a trusted identity source issues a token after authenticating the user, and that token is what other systems check instead of re-authenticating.
• Kerberoasting — requesting a Kerberos service ticket for a service account (any authenticated user can do this, no alert triggered), then cracking it offline to recover that account's password hash.
• CVE (Common Vulnerabilities and Exposures) — the standard ID assigned to a specific known vulnerability.
• CVSS (Common Vulnerability Scoring System) — the standard severity score (0-10) for a CVE.
• Red team / Blue team / Purple team — red = offense, simulates real attackers; blue = defense, detection & response; purple = collaboration between the two to improve detection.
• Pentest vs. vulnerability scan — a vuln scan is automated, passive, matches known signatures/CVEs; a pentest is human-driven, actively attempts real exploitation/chaining to validate actual risk.
• CNA (CVE Numbering Authority) — an organization authorized to mint CVE IDs for a defined scope (its own products, a coordinator role, etc.). Most CVEs today are assigned by vendor CNAs or bug-bounty-platform CNAs (HackerOne, Bugcrowd), not by MITRE directly.
• CNA-LR (CNA of Last Resort) — MITRE's role: assigns CVE IDs via a request form when no vendor/coordinator CNA covers the affected product. Slower than going through a dedicated CNA.
• CERT/CC (CERT Coordination Center, Carnegie Mellon) — a third-party coordinator CNA, useful when a vendor is unresponsive, has no security contact, or an issue spans multiple vendors.
• Coordinated disclosure — reporting a vulnerability privately to the affected vendor first (rather than publishing immediately), giving them time to patch before any public CVE/details are released; the norm the whole CVE submission process assumes.
• CWE (Common Weakness Enumeration) — the taxonomy of vulnerability types (e.g. "CWE-79: Cross-Site Scripting"). A CVE identifies one specific instance of a flaw in a specific product; CWE classifies what kind of flaw it is.
• NVD (National Vulnerability Database) — NIST's database that enriches published CVEs with a CVSS score and structured metadata after a CNA assigns the ID.

OT/ICS Fundamentals

• IT vs OT priority — IT security follows Confidentiality→Integrity→Availability (CIA); OT security flips it to Availability→Integrity→Confidentiality (AIC), because OT systems control physical processes where downtime/instability can cause physical harm.
• ICS (Industrial Control Systems) — umbrella term for equipment/software controlling physical industrial processes (PLCs, RTUs, HMIs, SCADA, DCS).
• SCADA (Supervisory Control and Data Acquisition) — a type of ICS focused on supervising geographically distributed systems (e.g. a utility grid or pipeline).
• DCS (Distributed Control System) — a type of ICS typically used within a single plant/site rather than spread over distance.
• PLC (Programmable Logic Controller) / RTU (Remote Terminal Unit) — the field-level controllers that read sensors and drive actuators in tight, fast loops (Purdue Level 1).
• HMI (Human-Machine Interface) — the operator-facing dashboard/screen showing live process data (Purdue Level 2).
• Historian — a database logging sensor/process data over time, typically at Purdue Level 3.
• Purdue Model — reference architecture mapping OT/IT network layers, Level 0 (physical sensors/actuators) up to Level 5 (corporate/enterprise); the IT/OT security boundary is conventionally drawn around Level 3/3.5.
• Level 3.5 / DMZ — the firewalled buffer zone mediating any traffic between OT (Levels 0-3) and IT (Levels 4-5); the main real-world security boundary in practice.
• Air-gapped — historically meant zero physical connectivity between OT and IT; in practice today almost nothing is truly air-gapped, so security work focuses on controlling the Level 3.5 boundary instead.
• Passive monitoring — watching a copy of network traffic (via a tap/span port) rather than actively scanning/injecting packets, because active scans can crash fragile field devices never built to handle unexpected input.
• Modbus — the oldest/most universal ICS protocol (1979); plaintext, no authentication; the canonical example of "ICS protocols have no security by design."
• DNP3 (Distributed Network Protocol) — dominant protocol for North American electric/water utility master-station-to-RTU communication; has an optional auth extension (DNP3-SA) rarely enabled in practice.
• IEC 61850 — modern substation automation standard for electric utilities; includes GOOSE messages.
• GOOSE (Generic Object Oriented Substation Event) — peer-to-peer protection-relay messages requiring single-digit-millisecond delivery, with essentially no authentication due to the speed requirement; a known attack surface (used in the 2016 Ukraine grid attack, Industroyer malware).
• IEC 60870-5-104 ("IEC 104") — DNP3's rough European/Middle-East equivalent protocol.
• OPC-UA — a newer IT/OT bridging protocol (e.g. historian-to-cloud) that, unlike the field-level protocols above, was built with authentication and encryption from the start.

OT Attack Case Studies

• Stuxnet (2010) — malware delivered via USB to Iran's Natanz facility, targeted Siemens PLCs to physically destroy uranium centrifuges by subtly altering their speed, while feeding operators falsified "everything normal" readings. Canonical example of an OT integrity attack — not data theft, not an obvious outage, just making the physical process do the wrong thing while lying to the humans monitoring it. Widely attributed to a US/Israel joint operation, never officially confirmed.
• Ukraine grid attacks (2015, 2016) — first confirmed cyberattacks to cause a power outage. 2015: Sandworm (Russian GRU-linked) phished into utility IT, pivoted to OT, manually opened substation breakers via SCADA HMI (~230,000 people lost power). 2016: follow-up used Industroyer malware, the first malware built to natively speak ICS protocols (including IEC 61850 GOOSE) to automate breaker control at scale instead of manual HMI clicks.
• TRITON / TRISIS (2017) — targeted a Saudi petrochemical plant's Safety Instrumented System (SIS) — the independent emergency-shutdown layer that exists to prevent physical catastrophe (explosion, toxic release). Reprogrammed Schneider Electric SIS controllers; a bug in the attacker's own code accidentally triggered a shutdown, likely preventing serious harm. The case study proving OT attacks carry real physical/safety risk, not just theoretical danger.
• SIS (Safety Instrumented System) — an independent hardware/software layer that triggers automatic emergency shutdown if a process becomes physically dangerous, separate from the normal control system.
• Metcalf sniper attack (2013) — attackers shot up a PG&E transmission substation in California, knocking out 17 transformers. Physical, not cyber, but the case study behind NERC CIP-014 (mandating physical security planning for critical substations) — cited to make the point that critical-infrastructure risk isn't purely digital.

OT Vendor Landscape

• Dragos — pure-play OT threat detection & intel vendor; known for naming/tracking specific ICS-targeting threat groups (e.g. XENOTIME, linked to TRITON), similar to how CrowdStrike names IT-side APT groups.
• Claroty — pure-play OT asset visibility + exposure/vulnerability management; also strong in healthcare device security under the term "xIoT" (extended IoT — medical devices, building systems, etc. alongside classic ICS).
• Nozomi Networks — pure-play OT asset visibility + passive network threat detection; notable distribution partnership with Palo Alto Networks.
• Dragos/Claroty/Nozomi are referred to as the OT security "big three" — all compete on roughly the same product shape: passive network monitoring → asset inventory → anomaly/threat detection → vulnerability/exposure management.
• Tenable.ot — Tenable's OT product (from acquiring Indegy), bundled with their IT vulnerability-management business.
• Microsoft Defender for IoT — Microsoft's OT offering (from acquiring CyberX).
• Forescout / Armis — broader IT/OT/IoT device-visibility vendors with Network Access Control (NAC) roots, less ICS-protocol-specialized than the big three.
• Vendor-native OT security — control-system manufacturers (Siemens, Schneider Electric, Honeywell) selling their own security add-ons for their own equipment.

2026 OT Threat Landscape & Supply-Chain Targets

(from the Dragos 2026 OT Cybersecurity Year in Review — see just-talking/cyber-reading-list)

• KAMACITE, SYLVANITE, BAUXITE — named OT-targeting threat groups tracked by Dragos as active in 2026; BAUXITE notably deployed wiper malware alongside hacktivist messaging campaigns.
• MSP (Managed Service Provider) — a third party remotely managing IT/OT infrastructure (patching, monitoring, help desk) for multiple clients. A high-value supply-chain target because compromising one MSP can grant privileged access into all of its downstream clients at once (cf. the Kaseya ransomware incident).
• GIS (Geographic Information System) — software mapping/managing geospatial data. For utilities, GIS holds the physical topology (which pole feeds which transformer, pipeline routing, substation locations) — a reconnaissance goldmine for an attacker trying to map control loops and physical dependencies, which the 2026 Dragos report flagged as a rising adversary behavior.
• Engineering firms, system integrators, vendors, MSPs, and GIS providers are collectively the "trusted access periphery" around a utility — 2026 attacker focus has shifted toward this periphery rather than the utility's own network directly, since these firms hold privileged access or critical mapping data across multiple client environments.

Compliance / Frameworks

• NERC (North American Electric Reliability Corporation) — the organization overseeing bulk power system reliability across North America.
• NERC CIP (Critical Infrastructure Protection) — NERC's mandatory, legally-enforced cybersecurity standards for the electric grid; not a voluntary best-practice framework like NIST CSF. Overseen/enforced by FERC, with fines up to $1M+/day per violation.
• FERC (Federal Energy Regulatory Commission) — the US federal regulator that oversees and enforces NERC standards.
• BES (Bulk Electric System) — the scope of NERC CIP: roughly the high-voltage transmission-level grid (generally 100kV+), not every piece of electric infrastructure. Small distribution-only utilities may fall outside CIP scope.
• NERC CIP is electric-sector only — water utilities fall under EPA/AWIA requirements instead, and gas pipelines under TSA security directives, not NERC CIP.
• CIP-002 — categorize BES Cyber Systems by impact (High/Medium/Low); the mandatory starting point for all other CIP standards.
• CIP-005 — Electronic Security Perimeter (ESP): the legal/compliance formalization of the Purdue Level-3.5 segmentation boundary.
• CIP-007 — system security management (patching, ports/services hardening), with the OT-specific tension that you can't patch live field devices the way you'd patch a laptop.
• CIP-008 — incident reporting and response planning requirements.
• CIP-010 — configuration change management and vulnerability assessments.
• CIP-013 — supply chain risk management (added ~2020): the standard legally requiring utilities to vet third-party/vendor/MSP access — directly related to the MSP/GIS supply-chain targeting trend above.
• CIP-014 — physical security requirements for critical substations, added in response to the 2013 Metcalf sniper attack.

Networking / Crypto Primitives

• TLS (Transport Layer Security) — the standard encryption/authentication protocol behind HTTPS; assumes a reliable, ordered, connection-based transport (TCP).
• DTLS (Datagram Transport Layer Security) — TLS adapted to run over UDP instead of TCP, adding handshake retransmission and tolerance for packet loss/reordering/duplication since UDP gives none of that natively. Used wherever "HTTPS-grade" security is needed over a latency-sensitive, connectionless channel — VPN tunnel modes (e.g. Cisco AnyConnect), WebRTC, CoAP for constrained/IoT devices. Most classic field-level ICS protocols (Modbus, DNP3, GOOSE) predate DTLS and don't use it natively.