100 Words Every Network Security Analyst Should Know

No.	Item	Definition
1.	ACL	traffic permission rule list
2.	alert	warning of suspicious activity
3.	anomaly	unusual behavior or pattern
4.	ARP	maps IP to hardware address
5.	authentication	verifying identity
6.	authorization	granting allowed access
7.	backdoor	hidden unauthorized access method
8.	baseline	normal behavior reference
9.	beaconing	periodic contact with controller
10.	BGP	internet routing protocol
11.	botnet	network of infected devices
12.	breach	unauthorized data exposure
13.	brute force	guessing many password combinations
14.	C2	attacker command channel
15.	certificate	digital identity document
16.	ciphertext	encrypted unreadable data
17.	containment	limiting incident spread
18.	credential	login identity information
19.	CVE	public vulnerability identifier
20.	DDoS	traffic flood disrupting service
21.	decryption	turning ciphertext into plaintext
22.	DHCP	assigns IP settings automatically
23.	DLP	data loss prevention
24.	DNS	system mapping names to addresses
25.	DNSSEC	DNS integrity protection
26.	domain	named internet namespace
27.	EDR	endpoint detection and response
28.	egress	outbound network traffic
29.	encryption	encoding data for secrecy
30.	enumeration	listing users or services
31.	eradication	removing threat from systems
32.	evasion	avoiding security detection
33.	exfiltration	unauthorized data removal
34.	exploit	code abusing a weakness
35.	firewall	filters network traffic
36.	forensics	investigation of digital evidence
37.	gateway	device linking networks
38.	hardening	reducing attack surface
39.	hash	fixed-length data fingerprint
40.	honeypot	decoy system for attackers
41.	hostname	device name on network
42.	HTTPS	secure web transfer protocol
43.	IDS	system that detects intrusions
44.	IMAP	email retrieval protocol
45.	incident	security event requiring response
46.	ingress	inbound network traffic
47.	IOC	indicator of compromise
48.	IP address	numeric network identifier
49.	IPS	system that blocks intrusions
50.	IPsec	suite securing IP traffic
51.	keylogger	tool recording keystrokes
52.	kill chain	stages of an attack
53.	lateral movement	spreading across internal systems
54.	least privilege	minimum necessary access
55.	log	record of events
56.	MAC address	hardware network identifier
57.	malware	harmful software
58.	MFA	multiple login verification factors
59.	MITM	intercepting communications between parties
60.	NAC	network access control
61.	NAT	address translation method
62.	Nmap	network scanning tool
63.	obfuscation	making code hard to read
64.	packet	unit of network data
65.	patch	software fix
66.	persistence	maintaining access over time
67.	phishing	fraudulent message to steal data
68.	port	numbered network service endpoint
69.	privilege escalation	gaining higher permissions
70.	protocol	communication rules
71.	proxy	intermediary network server
72.	quarantine	isolating suspicious files
73.	ransomware	malware that demands payment
74.	RDP	remote desktop protocol
75.	reconnaissance	gathering target information
76.	recovery	restoring normal operations
77.	rootkit	malware hiding deep access
78.	router	device forwarding packets
79.	sandbox	isolated testing environment
80.	SIEM	security event monitoring platform
81.	sniffing	capturing network traffic
82.	spoofing	forging identity or source
83.	spyware	software that secretly monitors
84.	SSH	secure remote access protocol
85.	subnet	smaller network segment
86.	switch	device connecting local devices
87.	TCP	reliable transport protocol
88.	TLS	protocol securing data in transit
89.	token	digital proof of identity
90.	triage	prioritizing incidents quickly
91.	trojan	malware disguised as legitimate
92.	UDP	connectionless transport protocol
93.	virus	self-replicating malicious code
94.	VPN	secure private network tunnel
95.	vulnerability	security weakness
96.	WAF	web application firewall
97.	Wireshark	packet analysis tool
98.	worm	self-spreading malware
99.	YARA	malware matching rule language
100.	zero-day	unknown unpatched vulnerability