🔐 Cybersecurity Terminology Glossary: 55 Essential Terms Explained

Why These Terms Matter

Cybersecurity has its own vocabulary, and in industrial and building-systems engineering that vocabulary increasingly overlaps with electrical, controls, and network engineering. A fire alarm panel, a building automation system, a SCADA historian, and a hospital infusion pump are all now "assets" in a cybersecurity risk register, and the engineers who design, specify, and maintain them are expected to speak the language of the security teams they coordinate with. Misreading a term — confusing "vulnerability" with "threat," or "authentication" with "authorization" — leads to gaps in system design, weak contract language, and failed audits.

This glossary defines 55 of the terms most likely to appear in a security assessment, an RFP for a building or industrial control system, a NIST or IEC 62443 compliance conversation, or a conversation with an IT/OT security team. Terms are organized alphabetically, with standard references (NIST, IEC 62443, MITRE ATT&CK, ISO/IEC 27001) noted where applicable.

A

Advanced Persistent Threat (APT) — MITRE ATT&CK

A well-resourced, often state-sponsored or organized-crime attacker that gains and maintains long-term, low-visibility access to a network rather than smashing and grabbing. APTs are named and tracked (e.g., APT28, APT41) because their tools and techniques recur across campaigns. In OT/ICS environments, APTs are the primary concern behind hardening programs — they have the patience to study a control system for months before acting.

Air Gap — IEC 62443

The physical isolation of a network from any other network, including the internet, with no direct electronic connection. A true air gap is increasingly rare in modern industrial systems because of remote monitoring and vendor support needs; most "air-gapped" systems today are actually protected by a data diode or a tightly controlled jump host instead, which is a meaningfully weaker (though often necessary) control.

Asset Inventory — NIST CSF (Identify function)

A maintained list of every device, system, and software component connected to a network, including make, model, firmware version, IP address, and owner. In OT environments this is harder than it sounds — legacy PLCs and RTUs are often undocumented "shadow" assets. NIST CSF and IEC 62443 both treat an accurate asset inventory as the prerequisite for every other control; you cannot patch, segment, or monitor what you do not know exists.

Attack Surface — General infosec term

The complete set of points where an unauthorized user could try to enter or extract data from a system — open ports, exposed APIs, remote access portals, USB ports, wireless interfaces, and even social-engineering targets like help-desk staff. Reducing attack surface (closing unused ports, disabling unused services, removing unnecessary remote access) is one of the highest-value, lowest-cost security improvements available.

Authentication — NIST SP 800-63

The process of verifying that a user, device, or system is who or what it claims to be — typically via a password, certificate, token, or biometric. Authentication answers "who are you?" It is distinct from authorization, which answers "what are you allowed to do?" Multi-factor authentication (MFA) strengthens this step by requiring two or more independent proof factors.

Authorization — NIST SP 800-63

The process of granting or denying an authenticated identity access to specific resources or actions. A correctly authenticated operator might be authorized to view a SCADA screen but not authorized to change a setpoint. Confusing authentication with authorization is a common design flaw — systems that verify identity but grant blanket access afterward violate least-privilege principles.

B

Backdoor — General infosec term

A hidden method of bypassing normal authentication to gain access to a system, either intentionally built in by a vendor (for support access) or planted by an attacker after a successful compromise. Undocumented vendor backdoors are a recurring finding in ICS/OT vulnerability disclosures and are a key reason vendor remote-access accounts must be inventoried and controlled.

Baseline Configuration — NIST SP 800-53

A documented, approved snapshot of a system's settings, software, and configuration that serves as the reference point for detecting unauthorized change. Configuration drift — the gradual, undocumented divergence from baseline — is a leading indicator that a system may have been tampered with or is simply poorly maintained.

Botnet — General infosec term

A network of compromised devices (computers, IoT devices, cameras, routers) controlled remotely by an attacker, typically used to launch distributed denial-of-service (DDoS) attacks, send spam, or mine cryptocurrency. Poorly secured IoT and building-automation devices are common botnet recruits because they are internet-connected, rarely patched, and rarely monitored.

Business Continuity Plan (BCP) — ISO 22301

A documented plan describing how an organization continues critical operations during and after a disruptive event, including a cyber incident. In OT environments, the BCP typically includes manual operating procedures — the steps operators take to run a process safely when the control system itself is unavailable or untrusted.

C

CIA Triad — Foundational security model

The three core goals of information security: Confidentiality (preventing unauthorized disclosure of data), Integrity (preventing unauthorized modification of data), and Availability (ensuring authorized users can access data and systems when needed). IT security traditionally prioritizes confidentiality first; OT/ICS security typically flips the priority to availability and integrity first, since a control system going offline can be more dangerous than data being read.

Common Vulnerabilities and Exposures (CVE) — MITRE

A standardized identifier (e.g., CVE-2024-12345) assigned to a publicly disclosed software or hardware vulnerability so that different vendors, tools, and organizations can reference the same flaw consistently. CVSS (Common Vulnerability Scoring System) scores rate the severity of each CVE on a 0-10 scale to help prioritize remediation.

Critical Infrastructure — CISA / Presidential Policy Directive 21

Systems and assets so vital that their incapacity or destruction would have a debilitating effect on national security, economic security, or public health and safety. CISA designates 16 critical infrastructure sectors, including energy, water, healthcare, and communications — the sectors where OT/ICS cybersecurity engineering is most heavily regulated.

Cryptographic Hash Function — NIST FIPS 180-4

A one-way mathematical function that converts data of any size into a fixed-length string (a "hash") such that even a tiny change to the input produces a completely different hash. Hashes are used to verify file integrity (a downloaded firmware image's hash should match the vendor's published value) and to store passwords without keeping the plaintext.

D

Data Diode — IEC 62443

A hardware device that physically enforces one-way data flow, typically from a secure OT network out to a less-trusted IT network, with no return path possible even if software is compromised. Data diodes are used where full air-gapping is impractical but bidirectional connectivity is unacceptable — for example, streaming historian data out of a control network for business reporting.

Defense in Depth — NIST SP 800-53 / IEC 62443

A layered security strategy where multiple independent controls (firewalls, segmentation, endpoint protection, monitoring, physical security, policy) each provide protection so that the failure of any single control does not result in compromise. IEC 62443's zone-and-conduit model is a direct application of defense in depth to industrial networks.

Denial of Service (DoS) / Distributed Denial of Service (DDoS) — General infosec term

An attack that overwhelms a system, network, or service with traffic or requests so that legitimate users cannot access it. A DDoS attack uses many distributed sources (often a botnet) simultaneously. In OT environments, availability-focused attacks are particularly dangerous because a control system rendered unresponsive can leave a process in an unsafe or unmonitored state.

Demilitarized Zone (DMZ) — IEC 62443 / Purdue Model

A network segment that sits between two zones of differing trust levels (typically the IT business network and the OT control network) to broker any necessary communication without allowing direct connections between the two. In the Purdue Model, the DMZ sits at Level 3.5, hosting proxies, patch-management servers, and historian replicas so that neither network talks directly to the other.

E

Encryption — NIST FIPS 197 (AES)

The process of converting readable data (plaintext) into an unreadable form (ciphertext) using a mathematical algorithm and a key, such that only someone with the correct key can reverse the process. Encryption protects data at rest (stored files) and in transit (network traffic). AES-256 is the current standard symmetric algorithm for most government and industrial applications.

Endpoint Detection and Response (EDR) — General infosec term

Software installed on individual devices (endpoints) that continuously monitors for suspicious behavior, collects forensic data, and can automatically isolate or remediate a compromised device. EDR is common on IT workstations and servers but is often impractical on legacy OT devices (PLCs, RTUs) that cannot run additional software — which is why OT security relies more heavily on network-based monitoring instead.

Exploit — General infosec term

A piece of code, technique, or sequence of commands that takes advantage of a specific vulnerability to cause unintended behavior — often gaining unauthorized access or control. An exploit is the "weapon"; a vulnerability is the "unlocked door" it uses.

F

Firewall — General infosec term

A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined rules, creating a controlled boundary between networks of differing trust. Next-generation firewalls (NGFWs) add deep packet inspection and application awareness beyond simple port/IP filtering; industrial firewalls additionally understand OT protocols like Modbus and DNP3 well enough to enforce rules on specific commands.

Firmware — General engineering term

Low-level software permanently or semi-permanently embedded in a hardware device (a PLC, camera, router, or sensor) that controls its basic operation. Firmware vulnerabilities are especially concerning in OT because firmware is rarely updated once a device is commissioned, and many legacy devices have no secure update mechanism at all.

G

Governance, Risk, and Compliance (GRC) — ISO/IEC 27001

An integrated approach to managing an organization's overall governance, enterprise risk management, and regulatory compliance, typically supported by dedicated software platforms. GRC programs are where cybersecurity policy, audit findings, and risk registers are tracked and reported to leadership and regulators.

H

Hardening — CIS Benchmarks / NIST SP 800-53

The process of reducing a system's attack surface by disabling unnecessary services, closing unused ports, removing default accounts and credentials, and applying secure configuration settings. CIS (Center for Internet Security) Benchmarks provide vendor-specific, step-by-step hardening guides for operating systems and common software.

Human-Machine Interface (HMI) — ISA/IEC 62443

The screen and controls through which an operator monitors and interacts with an industrial process — the "SCADA screen." HMIs are frequent attack targets because they are often Windows-based, internet-adjacent, and directly capable of issuing commands to physical equipment.

I

Identity and Access Management (IAM) — NIST SP 800-63

The overarching discipline and set of technologies (directories, single sign-on, MFA, privileged access management) used to ensure the right individuals and systems have the right access to the right resources at the right time — and no more. IAM is the practical implementation layer beneath the concepts of authentication and authorization.

Incident Response (IR) — NIST SP 800-61

The organized process an organization follows to detect, contain, eradicate, and recover from a security incident, typically documented in an Incident Response Plan with defined roles, communication trees, and playbooks for common scenarios. NIST SP 800-61 defines the standard four-phase lifecycle: Preparation; Detection & Analysis; Containment, Eradication & Recovery; and Post-Incident Activity.

Indicator of Compromise (IOC) — MITRE / threat intelligence term

Forensic evidence that a system may have been breached — a malicious file hash, a suspicious IP address, an unusual outbound connection, or an unexpected registry key. Security teams share IOCs through threat-intelligence feeds so that other organizations can proactively search their own environments for the same evidence.

Intrusion Detection System (IDS) / Intrusion Prevention System (IPS) — General infosec term

An IDS passively monitors network traffic or host activity for known-malicious patterns and alerts on matches; an IPS sits inline and can actively block traffic matching those patterns. OT-specific IDS products are typically deployed passively (via a network tap or switch mirror port) because inline blocking risks disrupting real-time control traffic.

ISO/IEC 27001 — ISO standard

The international standard for an Information Security Management System (ISMS) — a systematic, risk-based framework for establishing, implementing, and continually improving an organization's information security program. Certification against ISO/IEC 27001 is often a contractual requirement for vendors and integrators handling sensitive client data.

J

Jump Host (Jump Server) — IEC 62443

A hardened, tightly monitored intermediary server that administrators or vendors must connect through to reach devices in a more sensitive network zone, rather than connecting directly. Jump hosts centralize logging and access control for remote support sessions into OT networks and are a standard control for vendor remote access.

K

Kill Chain — Lockheed Martin Cyber Kill Chain / MITRE ATT&CK

A model describing the sequential stages an attacker typically moves through to achieve an objective — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use the kill-chain concept to identify the earliest stage at which an attack can realistically be detected or stopped, since later-stage detection is far more costly.

L

Lateral Movement — MITRE ATT&CK

The techniques an attacker uses to move from an initially compromised system deeper into a network in search of higher-value targets, such as domain controllers or engineering workstations. Network segmentation and least-privilege access are the primary controls that slow or stop lateral movement, which is why they are emphasized so heavily in OT security guidance.

Least Privilege — NIST SP 800-53

The principle that every user, process, or system should be granted only the minimum access necessary to perform its function, and no more. An operator account that can view every HMI screen in a plant but only issue commands on the screens relevant to their assigned area is an example of least privilege correctly applied.

Log Management — NIST SP 800-92

The collection, storage, and retention of event records generated by systems, applications, and security tools, forming the raw material for detection, investigation, and compliance reporting. Centralized log management (feeding a SIEM) is what allows an analyst to reconstruct the timeline of an incident across many devices.

M

Malware — General infosec term

Any software intentionally designed to cause damage, gain unauthorized access, or disrupt normal operation — an umbrella term covering viruses, worms, trojans, ransomware, and spyware. Malware purpose-built for industrial targets (such as Stuxnet, Industroyer, and Triton) is specifically engineered to manipulate or damage physical processes, not just steal data.

Man-in-the-Middle (MITM) Attack — General infosec term

An attack in which an adversary secretly intercepts and potentially alters communication between two parties who believe they are communicating directly with each other. Encrypting traffic and using mutual authentication (both parties verify each other's identity) are the primary defenses.

MITRE ATT&CK — MITRE Corporation

A publicly available, continuously updated knowledge base of real-world adversary tactics and techniques, organized into a matrix that maps attacker goals (tactics) to the specific methods (techniques) used to achieve them. A dedicated ATT&CK for ICS matrix exists specifically for industrial control system threats. Security teams use ATT&CK to structure threat modeling, detection engineering, and red-team exercises around observed real-world behavior rather than hypothetical attacks.

Multi-Factor Authentication (MFA) — NIST SP 800-63B

An authentication method requiring two or more independent verification factors — something you know (password), something you have (a token or phone), or something you are (biometric) — before granting access. MFA is one of the highest-return security controls available, since it defeats most credential-theft-based attacks even when a password has been compromised.

N

Network Segmentation — IEC 62443 (zones and conduits)

Dividing a network into smaller, isolated segments so that a compromise in one segment cannot freely spread to others, with traffic between segments controlled through defined, monitored chokepoints. IEC 62443 formalizes this as "zones" (groups of assets with similar security requirements) connected by "conduits" (the controlled pathways between them) — the foundational architectural concept in OT/ICS security.

NIST Cybersecurity Framework (CSF) — NIST

A voluntary, risk-based framework organizing cybersecurity activities into six core functions: Govern, Identify, Protect, Detect, Respond, and Recover (Govern was added in the 2024 CSF 2.0 update). It is widely adopted across industries — including critical infrastructure — as a common language for describing and maturing a security program, without prescribing specific technologies.

NIST SP 800-53 — NIST

A comprehensive catalog of security and privacy controls for federal information systems (and widely adopted voluntarily elsewhere), organized into control families such as Access Control, Incident Response, and System and Communications Protection. It is the control catalog most often referenced when an organization needs to demonstrate exactly which technical safeguards satisfy a given risk.

O

Operational Technology (OT) — IEC 62443

Hardware and software that detects or causes changes in physical processes through direct monitoring or control of physical devices — PLCs, RTUs, DCS, SCADA, and building automation controllers. OT security differs from IT security primarily in its priorities (availability and safety over confidentiality) and its constraints (long device lifespans, real-time requirements, and limited tolerance for patching downtime).

Out-of-Band (OOB) Management — General networking term

A separate, dedicated network path used to manage and monitor devices that is physically or logically independent of the primary production network. OOB management allows administrators to reach and recover devices even if the main network is congested, segmented off, or compromised.

P

Patch Management — NIST SP 800-40

The process of identifying, testing, and deploying software and firmware updates that fix known vulnerabilities. In OT environments, patch management is deliberately slower and more cautious than in IT — patches must be validated on a test system first because an update that destabilizes a control system can be more dangerous than the vulnerability it fixes.

Penetration Testing (Pen Test) — NIST SP 800-115

An authorized, simulated attack against a system or network performed to identify exploitable vulnerabilities before real attackers do, typically concluding with a detailed report of findings and remediation recommendations. OT penetration testing requires specialized methodology and extreme caution, since aggressive scanning or exploitation techniques safe on IT systems can crash fragile industrial controllers.

Phishing — General infosec term

A social-engineering attack, typically delivered by email, that attempts to trick a recipient into revealing credentials, clicking a malicious link, or opening a malicious attachment by impersonating a trusted sender. Phishing remains the single most common initial-access technique across nearly all major breaches, including those that eventually reach OT networks through IT compromise.

Privileged Access Management (PAM) — NIST SP 800-53

Tools and processes that control, monitor, and audit the use of accounts with elevated permissions (administrator, root, or engineering-level accounts) — often including just-in-time access grants and session recording. PAM is especially important in OT because engineering workstations with programming access to PLCs represent some of the highest-consequence accounts in the entire environment.

Purdue Model (Purdue Enterprise Reference Architecture) — ISA-95 / IEC 62443

A reference architecture dividing an industrial enterprise into hierarchical levels — from Level 0 (physical process/sensors) up through Level 5 (enterprise IT) — used to design network segmentation and define where security controls belong. Level 3.5, the DMZ between OT (Levels 0-3) and IT (Levels 4-5), is the single most important boundary in the model for security architecture.

R

Ransomware — General infosec term

Malware that encrypts a victim's files or systems and demands payment (a "ransom") for the decryption key, often combined with a threat to publish stolen data ("double extortion"). Ransomware has become one of the most disruptive threats to OT environments, not because it typically targets control systems directly, but because IT-side ransomware forces plants to shut down out of caution when they lose visibility into or trust in their business systems.

Recovery Point Objective (RPO) / Recovery Time Objective (RTO) — Business continuity terms

RPO is the maximum acceptable amount of data loss, measured in time (e.g., "no more than 4 hours of data may be lost"), determining how frequently backups must be taken. RTO is the maximum acceptable time to restore a system after an outage. Both figures drive the design of backup, replication, and disaster-recovery architecture.

Risk Assessment — NIST SP 800-30

A structured process of identifying assets, threats, and vulnerabilities, then estimating the likelihood and impact of each risk scenario to prioritize mitigation. IEC 62443-3-2 requires a formal, documented risk assessment as the basis for assigning Security Levels to each zone in an industrial network.

Role-Based Access Control (RBAC) — NIST SP 800-53

An access-control model that grants permissions based on a user's assigned role (operator, engineer, administrator) rather than granting permissions to individuals one at a time. RBAC simplifies both the enforcement of least privilege and the auditing of who can do what.

S

Security Information and Event Management (SIEM) — General infosec term

A platform that aggregates and correlates log and event data from across an environment in real time, applying rules and analytics to surface potential security incidents for analyst review. A SIEM is the central nervous system of a Security Operations Center (SOC), turning raw logs from firewalls, servers, and endpoints into actionable alerts.

Security Level (SL) — IEC 62443-3-3

A rating (SL 0 through SL 4) assigned to a zone or conduit describing the level of protection required against a defined class of adversary, from casual/coincidental (SL 1) up to a highly resourced, well-funded attacker with extended means (SL 4). Security Levels let a design team specify measurable security requirements — SL-Target for what's needed, SL-Achieved for what's actually in place — the same way pressure or temperature ratings specify mechanical requirements.

Security Operations Center (SOC) — General infosec term

A centralized team (in-house or outsourced/managed) responsible for continuously monitoring, detecting, analyzing, and responding to cybersecurity incidents across an organization's environment. Many organizations now operate a dedicated OT-SOC function alongside the traditional IT SOC because OT alerts require different context and different response procedures.

Segmentation — see Network Segmentation

See Network Segmentation above.

Single Sign-On (SSO) — General IAM term

An authentication scheme allowing a user to log in once and gain access to multiple independent systems without re-entering credentials, typically brokered by an identity provider using a protocol like SAML or OpenID Connect. SSO improves both convenience and security (fewer passwords to manage and phish) but also concentrates risk — a compromised SSO identity provider can expose every connected system at once.

Social Engineering — General infosec term

Manipulating people, rather than exploiting technical flaws, into performing an action or divulging information that compromises security — phishing, pretexting, baiting, and tailgating into a secured facility are all forms of social engineering. It remains effective because it targets human trust and urgency rather than software.

Supply Chain Attack — MITRE ATT&CK / NIST SP 800-161

An attack that compromises a target indirectly by first compromising a trusted vendor, software update mechanism, or component supplier. The 2020 SolarWinds compromise is the canonical example: attackers inserted malicious code into a legitimate software update that was then trusted and installed by thousands of downstream organizations.

T

Threat — NIST SP 800-30

Any circumstance or event with the potential to adversely impact an organization's operations, assets, or people through unauthorized access, destruction, disclosure, or modification. A threat is distinct from a vulnerability (the weakness that could be exploited) and from risk (the combination of threat, vulnerability, and potential impact).

Threat Intelligence — General infosec term

Evidence-based knowledge about existing or emerging threats — including attacker tactics, indicators of compromise, and targeted sectors — used to inform security decisions. Sector-specific Information Sharing and Analysis Centers (ISACs), such as the E-ISAC for electricity and WaterISAC for water utilities, distribute threat intelligence tailored to critical infrastructure operators.

Two-Factor Authentication (2FA) — see Multi-Factor Authentication

A specific case of MFA using exactly two independent factors. See Multi-Factor Authentication above.

V

Virtual Private Network (VPN) — General networking term

An encrypted tunnel that extends a private network across a public or untrusted network, commonly used for secure remote access. VPNs providing remote access to OT networks are high-value targets and are increasingly being replaced or supplemented by zero-trust remote-access solutions that grant access to a specific application rather than the entire network.

Vulnerability — NIST SP 800-30

A weakness in a system, process, or control that could be exploited by a threat to cause harm — an unpatched software flaw, a misconfigured firewall rule, or an untrained employee are all vulnerabilities. Vulnerability management is the ongoing cycle of discovering, assessing, and remediating these weaknesses, distinct from the one-time act of finding a single flaw.

Z

Zero Trust — NIST SP 800-207

A security model built on the principle "never trust, always verify" — no user, device, or network location is trusted by default, even inside the traditional network perimeter; every access request is authenticated, authorized, and continuously validated based on context. Zero trust replaces the older "castle and moat" model, which assumed anything inside the firewall was safe — an assumption repeatedly proven false once attackers gained a single foothold.

Zero-Day Vulnerability — General infosec term

A vulnerability that is unknown to the vendor (and therefore has no available patch) at the time it is discovered or actively exploited — the vendor has had "zero days" to fix it. Zero-days are especially dangerous in OT because affected devices may remain unpatched for months or years even after a fix is eventually released, given the operational caution required before applying any OT update.