Glossary

Glossary#

A non-exhaustive glossary of recurring terms across this guide.

General#

The catch-all category for terms that span more than one discipline. ACID, idempotence, latency, and similar fundamentals that come up in storage, networking, distributed systems, and operations alike.

ACID#: Atomicity, Consistency, Isolation, Durability. The transactional guarantees of a relational database.
API#: Application Programming Interface. The contract a program exposes for other programs to use.
CAP theorem#: Brewer’s theorem: a distributed system cannot simultaneously provide Consistency, Availability, and Partition tolerance.
CDN#: Content Delivery Network. Cache layer at the edge for static / dynamic content.
CI / CD#: Continuous Integration / Continuous Delivery. Automated build / test / deploy pipelines.
CRUD#: Create, Read, Update, Delete. The four basic operations on a resource.
DAG#: Directed Acyclic Graph. Used in build systems, data pipelines, version control history.
DSL#: Domain-Specific Language. A small language designed for a narrow problem.
IaC#: Infrastructure as Code. Provisioning via declarative source files.
IDE#: Integrated Development Environment.
IDL#: Interface Definition Language. ProtoBuf, Thrift, GraphQL SDL, OpenAPI.
LSP#: Language Server Protocol. The standard for editor / language-tool integration.
MTTR#: Mean Time To Recover (or Repair / Restore). Operational reliability metric.
OIDC#: OpenID Connect. Identity layer on top of OAuth 2.0.
OWASP#: Open Web Application Security Project. Best-known for the OWASP Top 10.
PII#: Personally Identifiable Information. Subject to regulatory protections.
POSIX#: Portable Operating System Interface (IEEE 1003 / ISO 9945). Family of standards defining a portable Unix-like API and shell. Linux is mostly compliant but uncertified; macOS is certified. See Sh for the shell side.
RBAC#: Role-Based Access Control.
REST#: Representational State Transfer. HTTP-based API style with resource semantics.
RPC#: Remote Procedure Call. Calling a function as if it were local.
SBOM#: Software Bill of Materials. Manifest of dependencies in a build.
SLA / SLO / SLI#: Service Level Agreement / Objective / Indicator. SLI is the measurement; SLO the target; SLA the contract.
SOLID#: Single responsibility, Open/closed, Liskov substitution, Interface segregation, Dependency inversion.
TLS#: Transport Layer Security. Successor to SSL.
YAGNI#: You Aren’t Gonna Need It.

Concurrency and Distributed Systems#

The vocabulary around running computation across cores, hosts, and regions. CAP, consistency, consensus, partitions, and the related terms operators reach for when discussing distributed systems behavior.

At-least-once#: Delivery semantics: messages may be redelivered. Idempotent handlers required.
At-most-once#: Delivery semantics: messages may be lost but never duplicated.
Backpressure#: The mechanism by which a slow consumer signals a faster producer to slow down.
Beacon#: Periodic check-in from an implant / agent to a control server. In observability, a small periodic emission.
Bulkhead#: Compartmentalization of resources so failures in one area don’t drain another.
Circuit breaker#: Reliability pattern: fail fast when a downstream is unhealthy instead of piling on requests.
Eventual consistency#: Updates propagate over time; replicas converge if writes stop.
Idempotent#: An operation that is safe to apply multiple times with the same effect as applying it once.
Linearizability#: Strongest consistency model: operations appear to occur atomically in some order consistent with real-time.
Quorum#: The minimum number of nodes that must agree for a read or write to succeed.
Saga#: A sequence of local transactions that together form a distributed business process; failures trigger compensating transactions.

Security#

The security vocabulary an operator should be able to use without hesitation. Threat models, attack frameworks, defensive concepts, and the cryptographic primitives that show up across the handbook’s offensive and defensive pages.

ATT&CK#: MITRE’s catalog of adversary tactics, techniques, and procedures.
Blue Force#: Friendly forces. In CYBINT, the operator’s own side, the team that builds, instruments, and defends, set against OPFOR.
C2 / Control#: Command and Control. The interactive channel between an operator and a compromised system in a red-team engagement.
CVE#: Common Vulnerabilities and Exposures. The naming scheme for publicly known vulnerabilities (e.g. CVE-2024-12345).
CVSS#: Common Vulnerability Scoring System. 0-10 severity score for vulnerabilities.
EDR#: Endpoint Detection and Response. Host-level security telemetry and reaction.
IOC / IoC#: Indicator of Compromise. Hashes, IPs, domains, etc. used to detect known-bad activity.
IDS / IPS#: Intrusion Detection / Prevention System. Network monitor that detects (or blocks) malicious traffic.
KEV#: CISA’s Known Exploited Vulnerabilities list. CVEs known to be actively exploited.
MFA#: Multi-Factor Authentication. Two or more factors from {know, have, are}.
OPFOR#: Opposing force. The team that plays the adversary in training, generating the activity Blue Force collects and analyzes to improve tools and training.
Pen-test#: Penetration test. Authorized exercise simulating attacker behavior against a target.
Red / Blue / Purple team#: Offensive / Defensive / Combined team in security exercises.
ReDoS#: Regular Expression Denial of Service. Exponential backtracking triggered by adversarial input to a regex.
SIEM#: Security Information and Event Management. Aggregates and correlates log / event data.
Spoofing#: Pretending to be another principal: IP, email sender, user.
Tradecraft#: The professional methodology and discipline of operations work, in offensive security or intelligence.
XSS / CSRF / SSRF#: Cross-Site Scripting / Cross-Site Request Forgery / Server-Side Request Forgery. The most-cited web vulnerability classes.

DevOps and Infrastructure#

The deployment, infrastructure, and configuration vocabulary. Pipelines, GitOps, IaC, observability primitives, container runtimes, and the patterns (blue/green, canary, dark launch) that shape how operators ship change in production.

Blue / Green#: Deployment strategy: maintain two production environments; cut traffic between them to deploy.
Canary#: Deployment strategy: route a small fraction of traffic to a new version, expand if healthy.
Chaos Engineering#: Deliberately injecting failures into a system to test its resilience.
Container#: Process running in an isolated namespace with cgroup limits; the unit packaged by Docker / Podman / OCI.
Helm#: Package manager for Kubernetes. Chart = package, Release = installed instance.
Kubernetes#: Container orchestrator. Pod, Deployment, Service, Ingress, Namespace, ConfigMap.
GitOps#: Pull-based deployment model: the desired state lives in Git; a controller reconciles the cluster to match.
Operator#: Kubernetes pattern: custom resources + controller that automate lifecycle of a complex application.
Sidecar#: A second container running alongside the application container in the same pod (e.g. service-mesh proxy).

Data and Analytics#

The data-architecture and analytics terms. CDC, ETL/ELT, OLAP / OLTP, lakehouse, and similar; the words that come up around moving, transforming, and analyzing data at scale.

CDC#: Change Data Capture. Streaming database changes downstream.
CQRS#: Command Query Responsibility Segregation. Separate models for writes and reads.
ETL / ELT#: Extract, Transform, Load. ELT loads first then transforms, leveraging warehouse compute.
OLTP / OLAP#: Online Transaction Processing / Online Analytical Processing. Operational vs. analytical workloads.
Schema-on-read / on-write#: Whether the schema is enforced when data is read or when it is written.
Sharding#: Horizontal partitioning of data across nodes by some key.

Editors and Shells#

The vocabulary around the operator’s working environment. Editors and shells produce their own jargon: modal editing, LSP, Tree-sitter, REPL, prompt managers, and the related terms that come up across the docs/linux/editors and docs/linux/shells sections.

Modal editing#: Editing model where keystrokes mean different things depending on the current mode (Vim, Helix, Kakoune).
readline#: The GNU line-editing library used by Bash, Zsh, Python REPL, and many others.
REPL#: Read-Eval-Print Loop. An interactive interpreter session.
Tree-sitter#: Incremental parser-generator library; the basis of modern syntax-aware editor features.

Ops and SRE#

The operations vocabulary. SLO / SLI / SLA, error budgets, toil, postmortems, on-call, runbooks; the language Site Reliability Engineering teams use to talk about reliability as a product feature.

Error budget#: 1 - SLO. The amount of unreliability you can spend on velocity before you have to slow down.
Postmortem#: Blameless analysis of an incident: timeline, root causes, action items.
Runbook#: Documented procedure for handling a known operational situation.
Toil#: Manual, repetitive, automatable operational work.

Standards and Bodies#

The acronym soup of standards organizations, regulators, and trade bodies. Knowing which group owns a given specification or mandate is half of being able to find the authoritative document when one is needed.

CISA#: US Cybersecurity and Infrastructure Security Agency.
IANA#: Internet Assigned Numbers Authority. Maintains DNS root, IP address allocations, port numbers.
IETF#: Internet Engineering Task Force. Publishes RFCs.
ISO#: International Organization for Standardization. ISO/IEC standards (e.g. ISO/IEC 27001 for InfoSec management).
NIST#: US National Institute of Standards and Technology.
OCI#: Open Container Initiative. Container image and runtime specifications.
W3C#: World Wide Web Consortium. Web standards (HTML, CSS, WebAssembly).
WHATWG#: Web Hypertext Application Technology Working Group. Maintains living HTML and DOM standards.

Doctrine, IC, and Military#

The Ranger / SOF / Intelligence Community vocabulary the handbook borrows. F3EAD, D3A, the targeting cycle, the common abbreviations (TLP, METT-TC, OPORD, WARNO), and the analytical tradecraft terms (ACH, BLUF, key judgments) that travel from the IC into cyber practice.

AAR#: After-Action Review. Structured post-mission learning session; what was supposed to happen, what did happen, why, and what to sustain or improve. See Format.
ACH#: Analysis of Competing Hypotheses. Structured analytic technique for evaluating multiple explanations against the evidence.
Actions on the Objective#: The pre-rehearsed sequence the team executes once on target; assault, search, exploitation, consolidation. Civilian analog: the playbook the operator runs once initial access is in hand.
All-Source vs Single-Source#: All-source intelligence fuses every collection discipline; single-source rests on one (HUMINT only, SIGINT only). The operator’s analysis is almost always all-source; collection is almost always single-source.
Assembly Area#: The location a unit occupies to prepare for an operation; final checks, rehearsals, distribution. Civilian analog: the staging environment the operator uses before push.
Asset / Agent / Source#: In IC parlance, the human providing information. “Asset” and “agent” are interchangeable in CIA usage and refer to a recruited foreign national; the case officer is the US officer running the asset. “Source” is broader and includes walk-ins, liaison reporting, and technical sources.
Backbrief#: The subordinate’s restatement of the mission and intent back to the commander to confirm understanding before execution. Catches miscommunication before it becomes a casualty.
BDA#: Battle Damage Assessment. Post-strike measurement of effects on the target. Civilian analog: post-incident effect assessment (what the operator’s action actually did to the target).
BLUF#: Bottom Line Up Front. Lead with the conclusion; analytic and briefing convention across IC and SOF writing.
Bounding Overwatch#: Movement technique where one element advances while a partner element holds a position to observe and provide fires. Cyber analog: one tool advances on the target while another monitors defender response.
Branches and Sequels#: Branches are pre-planned alternatives to the main course of action (if A fails, do B). Sequels are pre-planned follow-ons (after success at A, exploit toward C).
Brush Pass#: A tradecraft technique in which two officers exchange material in passing without appearing to interact. The target moves only inches, the encounter lasts a beat. The cyber analog is any short-window, low-signature data handoff.
Burn / Compromise#: An operation, source, or technique is “burned” when the adversary becomes aware of it and counters. The compromised element must be retired and not reused; trying to reuse a burned tool is how secondary compromises happen.
Case Officer#: The US intelligence officer who recruits and runs human sources. The case officer is to the asset what the handler is to the agent in much of the literature.
CCIR#: Commander’s Critical Information Requirements. The information the commander needs in order to make a decision; pulls PIR and FFIR.
Center of Gravity (COG)#: The source of power that holds a system together. Identifying the adversary’s COG (and protecting one’s own) is the foundation of operational design.
COA Development#: Course-of-Action development. The middle of the planning process: brainstorm two or three feasible mission approaches, wargame each, recommend one. Avoids the single-COA trap.
Collection Plan#: The systematic mapping of what intelligence questions (PIR, CCIR) must be answered, by which discipline (HUMINT, SIGINT, OSINT, IMINT, GEOINT), against which targets, on which timeline.
Commander’s Intent#: The two-or-three-sentence statement of purpose, key tasks, and end state that lets subordinates act independently when the plan breaks. The operator’s equivalent of a mission charter.
COMO#: Combat Oriented Maintenance Organization. A maintenance unit structure designed to keep weapons, vehicles, and equipment mission-ready under field conditions, organised around the supported combat element rather than the workshop. Civilian analog: the on-call SRE rotation embedded with the product team rather than a central support queue.
COMSEC#: Communications Security. Keeping the contents of a transmission confidential and authentic.
Compartmentation#: Information limited to those with explicit need-to-know; breaches limited to one compartment. Civilian analog: blast- radius control through least privilege and tenanted secrets.
Confidence Levels#: The high / moderate / low scale IC analysts attach to a judgment to communicate how strong the evidence is, distinct from how likely the assessed outcome is.
Counter-Surveillance#: Active measures the operator takes to detect adversary surveillance: planned routes, choke points, dry-cleaning runs. Distinct from anti-surveillance (passively avoiding detection).
Counterintelligence (CI)#: The discipline of identifying, deceiving, and neutralizing adversary intelligence operations against the friendly side. Civilian analog: the insider-threat and adversary-attribution work the defender does about the people, not the network.
Cover (operational, for action, for status)#: The plausible reason an officer is in a place doing a thing. Cover for status explains the role (the operator is a business consultant); cover for action explains the act (visiting a partner office). Both must hold up to scrutiny.
Culminating Point#: The point at which an operation can no longer continue without resupply or risk of reversal. The operator who passes culminating point usually loses; the operator who anticipates it wins.
Cut-out#: An intermediary between two parties who must not connect directly: a person, a hop, a relay. Civilian analog: a redirector or jump host.
D3A#: Decide, Detect, Deliver, Assess. The deliberate joint targeting cycle (JP 3-60). Outer loop around F3EAD.
Dangle#: A controlled asset offered to the adversary’s intelligence service in the hope of penetrating it. High-risk; rarely a small-unit operator’s call.
Dead Drop#: A pre-arranged place where two parties leave material for one another without meeting. Cyber analog: writing to a shared cloud bucket, IPFS hash, or drafts folder both sides agree on.
Decision Point#: A pre-identified place or time at which the commander commits to a branch of the plan. See Decision Points.
Decisive Operation / Shaping Operation#: The decisive operation directly accomplishes the mission; shaping operations create conditions for it. Civilian analog: the actual exploit vs all the recon and prep that enables it.
Decisive Point#: A geographic place, key event, or system whose seizure or neutralization yields a marked advantage and is essential to the mission’s success.
Denial and Deception (D&D)#: Adversary tradecraft of denying the friendly side accurate information (denial) and feeding deliberately false information (deception). The defender’s mirror of friendly OPSEC and PSYOP.
Denied Area#: Operating environment where movement is observed and acted on by the adversary. Civilian analog: a target network with active EDR, threat hunting, and a competent defender.
Direct Action (DA)#: Short-duration, small-unit offensive action against a target. Civilian analog: the operator’s actual on-target activity, as distinct from the surrounding recon, infil, exfil.
EEFI#: Essential Elements of Friendly Information. What the operator must deny the adversary about the friendly side.
EMSEC / TEMPEST#: Emanations Security. The discipline of preventing electronic devices from leaking processed information through compromising emanations (RF, acoustic, optical, power-line).
Estimative Language#: The standardized vocabulary IC analysts use to communicate probability (“almost certainly”, “likely”, “even chance”, “unlikely”, “remote chance”). Avoids the false precision of percentages and the false vagueness of “it could happen”.
F3EAD#: Find, Fix, Finish, Exploit, Analyze, Disseminate. The SOF targeting cycle developed inside JSOC; tighter, intel-driven inner loop within D3A.
FFIR#: Friendly Force Information Requirements. What the commander needs to know about friendly forces.
Find-Fix-Finish#: The first three legs of F3EAD; locate the target, hold it under continuous coverage, take action. The operator’s inner targeting loop.
Fire and Maneuver#: Coordinated movement under suppressing fire: one element fires while another moves. Cyber analog: noisy decoy traffic that lets the real action approach the target unobserved.
FRAGO#: Fragmentary Order. Short order modifying an existing OPORD. See Fragmentary Orders (FRAGO).
Handler#: In SIS / Mossad / general spy-novel parlance, the officer running an agent; in CIA usage the equivalent role is case officer.
Hasty Defense / Deliberate Defense#: Hasty defense is the position the team takes when contact is imminent and there is no time to prepare; deliberate defense is the prepared position with rehearsed sectors of fire. Civilian analog: panic patching vs hardening done before the campaign opened.
Hide Site#: Concealed position from which a team observes or rests. Cyber analog: a quiet beachhead the operator holds without acting, waiting for the right window.
HUMINT#: Human Intelligence. Information collected from people: conversations, debriefs, recruited assets, walk-ins, liaison reporting. The original collection discipline.
HVT#: High-Value Target. A person, system, or capability whose loss degrades the adversary disproportionately. Selected deliberately, not opportunistically.
IC#: Intelligence Community. The 18 US federal agencies under the Director of National Intelligence (CIA, NSA, DIA, NGA, FBI/IB, etc.).
IIR#: Intelligence Information Report. The IC’s standard format for reporting raw collected information from a single source, with source description and collection details, before any analytic spin.
IMINT#: Imagery Intelligence. Information derived from photographs, satellite or aerial imagery, video. Modern IMINT bleeds into GEOINT.
GEOINT#: Geospatial Intelligence. Information about activity on the earth’s surface derived from imagery, mapping data, and georeferenced telemetry; the discipline of “where” plus “what”.
Indicators and Warnings (I&W)#: Pre-defined observable signs that a particular adversary action is preparing or underway. The operator builds an I&W matrix during planning so the team recognizes contact rather than reasoning from first principles each time.
INTREP#: Intelligence Report. Routine reporting of collected intelligence.
IPOE / IPB#: Intelligence Preparation of the Operational Environment (IPOE, joint) / Battlefield (IPB, Army). The structured product the intelligence officer builds to characterize terrain, weather, and adversary before the team plans.
ISR#: Intelligence, Surveillance, and Reconnaissance. The umbrella term for the collection activities feeding the targeting cycle. In cyber terms, everything from passive recon through active scanning that builds the picture before action.
J2 / S2 / G2#: Intelligence officer at the joint / battalion / division level; the unit’s intelligence lead.
JSOC#: Joint Special Operations Command. The command echelon over Tier-1 SOF units (Delta, DEVGRU, 24th STS, ISA).
Key Judgments#: The two-to-five short statements at the top of an IC product summarizing what the analyst concluded and how confident they are. Read first, supports the reader who has time only for headlines.
LACE#: Liquid, Ammunition, Casualties, Equipment. The fast personnel- and-supply status report taken after contact. Cyber analog: the post-contact inventory of what’s still working, what’s burned, and who needs to rotate out.
Legend / Backstop#: A constructed identity (legend) and the supporting infrastructure (backstop: documents, records, references) that makes it hold up under scrutiny. Civilian analog: cover identities for offensive personas.
Linkup#: The deliberate joining of two friendly elements at a planned location. Cyber analog: scheduled rendezvous between the operator’s tools or teams across a partitioned environment.
Lines of Operation#: Logical paths that link the unit’s actions to the desired end state through a series of decisive points. The operator’s campaign plan.
Main Effort#: The single subordinate or task that, if it succeeds, the mission succeeds. Resources concentrate on the main effort; supporting efforts get what’s left.
MASINT#: Measurement and Signature Intelligence. The “everything else” discipline: spectroscopy, seismic, RF emissions, gait. Specialized; rare in cyber operator hands directly.
METT-TC#: Mission, Enemy, Terrain & weather, Troops & support, Time, and Civilians. The mnemonic for what the small-unit leader analyzes during TLP step 2. See METT-TC.
NAI / TAI#: Named Area of Interest (NAI) is a place collection focuses on; Target Area of Interest (TAI) is a place a friendly action will occur. The operator’s collection map and target map.
OAKOC#: Observation, Avenues of approach, Key terrain, Obstacles, Cover and concealment. The five-factor terrain analysis the operator runs during METT-TC. Cyber translation: visibility, network paths, key systems, defender obstacles, and the traffic / tradecraft that conceals movement.
OODA#: Observe, Orient, Decide, Act. John Boyd’s decision cycle. The defender’s loop in cyber operations.
OPORD#: Operations Order. The five-paragraph order (Situation, Mission, Execution, Sustainment, Command and Signal) used by US military for any deliberate operation. See Operations Order (OPORD).
OPSEC#: Operations Security. The discipline of denying adversaries the information they need to attack you, by controlling indicators in your own activity. See OPSEC.
ORP#: Objective Rally Point. The last covered, concealed position short of the objective where the team makes final preparations (rehearsal, equipment check, leader recce). The discipline that prevents the team arriving on target unready.
OSINT#: Open-Source Intelligence. Information collected from publicly available sources: web, social, public records, leaked dumps, commercial data. The dominant discipline for civilian operators and increasingly for IC consumers.
Op-Tempo#: The rate at which an operation produces decisions and actions. Sustainable op-tempo wins long campaigns; surge op-tempo wins short ones; mismatched op-tempo loses both.
Passage of Lines#: The deliberate procedure for one unit to move through another’s position without taking friendly fire. Civilian analog: the handoff between teams (recon to access, access to action) where the receiving team needs to know what to expect.
Patrol Base#: A short-duration, secured position from which a patrol operates and to which it returns. Cyber analog: a hardened persistent foothold the operator returns to between actions.
Pattern of Life#: The aggregated behavioral signature of a target over time: routines, contacts, locations, communications. Built up through F3EAD-Find collection; used to predict future location and to detect anomalies.
PCC#: Pre-Combat Checks. Individual-level confirmation of gear, weapons, comms, and contingencies before stepping off. Cyber analog: pre-engagement checklist the operator runs on their own tooling, credentials, infrastructure, and rollback plan.
PCI#: Pre-Combat Inspections. The leader-verified pass over each teammate’s PCC. Cyber analog: a teammate or lead reviewing the operator’s pre-engagement state before the window opens.
PCPAD-D#: Plan, Collect, Process, Analyze, Disseminate, with a feedback loop back to plan. The IC intelligence cycle (JP 2-0).
PIR#: Priority Intelligence Requirements. The intelligence the commander must have to plan and execute the mission.
Provocation#: Hostile-service tradecraft technique: induce the friendly side to act, then observe the response to map capabilities and people. Friendly side response is to recognize the bait, not chase it.
QRF#: Quick Reaction Force. The on-call team that responds to emerging incidents. Civilian analog: incident response.
Rally Point#: A pre-designated location to regroup after dispersal, compromise, or contact. The operator’s planned answer to “what if it goes wrong here?”.
Raw vs Finished Intelligence#: Raw intelligence is the original collected information (an IIR, a captured document); finished intelligence is the analytic product built on top of multiple raw inputs. Confusing the two is a standard amateur mistake.
Release Point#: The point at which a moving formation breaks down into sub-elements heading to their objectives. Cyber analog: the point in a script where the operation fans out across multiple targets.
Risk to Force / Risk to Mission (RTF / RTM)#: The two-axis risk frame planners use: how dangerous is this to the team, and how likely is mission success? An RTF-low, RTM-low option is rare; most plans trade one for the other.
ROC Drill#: Rehearsal of Concept. A walked or talked-through rehearsal of the plan, often with a sand-table or whiteboard, before live rehearsal. Catches plan flaws cheaply.
Safehouse#: A controlled location used for meetings, transit, holding, or cache. Civilian analog: a clean, attribution-isolated environment the operator uses for sensitive activity.
SALUTE#: Size, Activity, Location, Unit, Time, Equipment. Spot-report schema for observed activity.
Sanitization#: The deliberate removal of sources, methods, names, and other sensitive content from a product before it leaves a controlled channel. See Scrub.
SIGINT#: Signals Intelligence. Information derived from intercepted electronic emissions: communications (COMINT), electronic (ELINT), and foreign instrumentation (FISINT).
Signal Site#: A pre-arranged, observable mark used to communicate without contact: a chalk mark, a curtain position, a posted-sign tag. Cyber analog: an out-of-band channel beacon (a forum-post count, a DNS TTL change) signaling state.
Signature / Signature Reduction#: The set of observable artifacts an operator’s activity leaves behind. Signature reduction is the deliberate practice of lowering them: timing jitter, traffic blending, log rotation, artifact removal.
SITREP#: Situation Report. Routine reporting of friendly force status.
SLANT#: Personnel-status report (Strength, Leaders, Available, Needed, Time-needed, sometimes others depending on unit).
SOF#: Special Operations Forces. US: Army Special Forces, 75th Ranger Regiment, 160th SOAR, Naval Special Warfare (SEALs), AFSOC, MARSOC. Doctrinally: small-unit, deliberate, intelligence-driven.
Special Reconnaissance (SR)#: Persistent, low-signature observation of an adversary capability, target, or area. Distinct from Direct Action (DA); the SR team observes without acting on what they see.
Surveillance Detection Route#: Often shortened to SDR. A pre-planned movement pattern designed to expose hostile surveillance through controlled channelization, observation points, and pace changes. Cyber analog: deliberate, observable activity used to flush a defender’s hunt response. (The acronym SDR also refers to Software-Defined Radio in the RF section.)
Target Package#: The consolidated dossier on a target: pattern of life, infrastructure, defenses, options, authorities. Built before action; updated continuously.
Tearline#: The horizontal line in a classified product separating the sensitive original from a sanitized version that can be shared with a wider audience. Civilian analog: redaction line on an internal report when sharing externally.
TLP#: Troop Leading Procedures. The eight-step planning sequence for small-unit leaders. See Troop Leading Procedures.
TOC / JOC#: Tactical / Joint Operations Center. The unit’s command-and- control hub. Civilian analog: SOC.
TST#: Time-Sensitive Target. A target whose value or vulnerability window is short. Civilian analog: a fleeting collection opportunity (a misconfigured public bucket, a leaked credential still live) where speed matters more than polish.
Unconventional Warfare (UW)#: Operations conducted with, by, or through irregular forces in a hostile environment to coerce, disrupt, or overthrow a government or occupying power. Civilian analog: enabling friendly third parties rather than acting directly.
Vetting#: The process of validating a source’s bona fides, access, motivation, and reliability before treating their reporting as intelligence. Skipping vetting is how operations get fed bad information by an adversary.
Walk-in#: A volunteer source who appears on the friendly side’s doorstep offering information. Treated with skepticism (potential Provocation or Dangle) until vetted.
Wargaming#: The structured red-vs-blue rehearsal of each course of action during planning, action by action, looking for what the adversary does and what the friendly response is. Catches brittle assumptions before they cost lives.
WARNO#: Warning Order. Heads-up to subordinates that an OPORD is coming. See Warning Order (WARNO).

Networking#

The networking vocabulary an operator should know cold. Layer-by- layer terms (MAC, ARP, TCP, TLS, BGP, DNS), the names of the operational tools (firewall, IDS, IPS, WAF), and the abbreviations that show up in cloud-native and zero-trust architecture discussions.

ARP#: Address Resolution Protocol. Maps IPv4 addresses to MAC addresses on a local network segment.
ASN#: Autonomous System Number. The numeric identifier of a routing domain on the public internet.
BGP#: Border Gateway Protocol. The path-vector routing protocol that runs the public internet’s inter-AS routing.
CIDR#: Classless Inter-Domain Routing. The /N notation for expressing IP prefix length (e.g., 10.0.0.0/8).
DNAT / SNAT#: Destination / Source Network Address Translation. Rewriting the destination or source IP / port of a packet.
DNS#: Domain Name System. Resolves human-readable names to IP addresses (and many other record types: MX, TXT, CAA, SRV).
ICMP#: Internet Control Message Protocol. Diagnostics and error signaling for IP (ping, traceroute).
JA3 / JA4#: TLS client fingerprinting schemes. Hash of the ClientHello fields; used to identify clients without decrypting traffic.
MAC address#: Media Access Control address. The hardware-level identifier of a network interface.
MTU#: Maximum Transmission Unit. The largest packet size an interface will forward without fragmentation.
NAT#: Network Address Translation. Rewriting source / destination addresses, typically to share one public IP across many private hosts.
OSPF / IS-IS#: Interior gateway protocols. Link-state routing inside an AS.
SNI#: Server Name Indication. The TLS extension carrying the requested hostname; routinely used by middleboxes for routing and filtering before decryption.
VLAN#: Virtual LAN. Layer-2 segmentation within a physical switch infrastructure.
VPN#: Virtual Private Network. Tunnel that extends a private network across an untrusted one (IPsec, WireGuard, OpenVPN).

Cloud#

The cloud-platform vocabulary: managed services, identity, regions and zones, billing primitives, and the security and networking constructs (security groups, VPCs, IAM) that look similar across AWS / GCP / Azure but differ in important details.

ALB / NLB#: Application / Network Load Balancer (AWS terms). L7 vs L4 load balancing.
AZ#: Availability Zone. An isolated failure domain within a cloud region.
BYOK#: Bring Your Own Key. Customer-provided encryption keys.
IAM#: Identity and Access Management. The cloud’s authn/authz layer (users, roles, policies, federation).
KEK / DEK#: Key-Encryption Key / Data-Encryption Key. Two-tier key model; a small KEK protects many DEKs.
KMS#: Key Management Service. Managed key custody (AWS KMS, GCP KMS, Azure Key Vault).
Region#: Geographic grouping of availability zones (e.g., us-east-1).
Subnet#: A CIDR slice inside a VPC, typically bound to a single AZ.
VPC#: Virtual Private Cloud. The cloud-tenant’s private network segment.

Kubernetes#

The Kubernetes vocabulary every operator working in 2026 ends up fluent in. Pods, services, deployments, stateful sets, ingress, operators, CRDs, and the related concepts that surface in any kubectl describe output or production incident.

ConfigMap#: Kubernetes object holding non-secret configuration as key-value pairs.
CRD#: Custom Resource Definition. Extends Kubernetes with a new resource type; paired with a controller it forms an Operator.
DaemonSet#: Workload that runs one Pod per node (logging agent, CNI, node exporter).
Deployment#: Workload that manages a stateless ReplicaSet with rolling updates.
Ingress#: Kubernetes object that exposes HTTP / HTTPS routes from outside the cluster to Services.
NetworkPolicy#: Pod-to-pod firewall rules; default-deny is a common starting posture.
Pod#: The smallest deployable unit in Kubernetes; one or more co-located containers sharing a network namespace.
PVC / StorageClass#: Persistent Volume Claim / its provisioner. Storage abstraction for stateful workloads.
Service#: Stable virtual IP and DNS name for a set of Pods (ClusterIP, NodePort, LoadBalancer, ExternalName).
StatefulSet#: Workload that gives each Pod a stable identity, persistent storage, and ordered start / stop.
Taint / Toleration#: Mechanism for restricting which Pods can land on which nodes.

Web and Protocols#

The web platform and protocol vocabulary. HTTP method semantics, auth flows (OAuth, OIDC, JWT, SAML), real-time transports (WebSocket, SSE, WebRTC), and the protocol terms (CORS, CSP, HSTS) that operators encounter around browser security and API design.

CORS#: Cross-Origin Resource Sharing. Browser policy for HTTP requests across origins; controlled by the Access-Control-Allow-* response headers.
CSP#: Content Security Policy. HTTP response header restricting which sources the browser is allowed to load script / style / image from.
gRPC#: High-performance RPC framework over HTTP/2 with ProtoBuf payloads.
GraphQL#: Query language for APIs; client specifies exact structure of response.
HSTS#: HTTP Strict Transport Security. Tells the browser to talk to a site only over HTTPS.
JWT#: JSON Web Token. Compact, signed (and optionally encrypted) claims token; common in OAuth flows.
mTLS#: Mutual TLS. Both server and client authenticate with X.509 certificates.
OAuth 2.0#: Delegated-authorization framework; the authorization layer under most “log in with X” flows.
SAML#: Security Assertion Markup Language. XML-based federated SSO protocol; common in enterprise / Microsoft environments.
SameSite#: Cookie attribute restricting cross-site sending of cookies (Strict, Lax, None); CSRF mitigation.
SSE#: Server-Sent Events. Server-to-client one-way streaming over HTTP.
WebSocket#: Bidirectional message-oriented protocol over a single TCP connection upgraded from HTTP.

ML and NLP#

The machine-learning and natural-language vocabulary the analysis pages assume. Tokenization, embeddings, transformers, attention, prompting, RAG, and the metric / evaluation terms that come up around model development.

BPE#: Byte-Pair Encoding. Subword tokenisation used by GPT-family models.
Embedding#: Dense vector representation of a token, sentence, document, or image.
Fine-tuning#: Continuing training of a pretrained model on task-specific data.
Hallucination#: Confident generation of false content by an LLM.
LLM#: Large Language Model. Transformer trained on a large text corpus, typically billions of parameters.
NER#: Named Entity Recognition. Identifying spans referring to people, places, organizations, etc.
Perplexity#: Language-model evaluation metric: 2^(cross-entropy). Lower is better.
Prompt injection#: Adversarial input that overrides the model’s intended instructions.
RAG#: Retrieval-Augmented Generation. Pattern that feeds the LLM relevant context retrieved from a vector store.
RLHF#: Reinforcement Learning from Human Feedback. Alignment technique that trains a reward model from human preferences.
Transformer#: Neural-network architecture (Vaswani et al. 2017) built on self-attention; the basis of the modern LLM era.
Vector DB#: Database optimized for nearest-neighbor search over embeddings (FAISS, Chroma, Qdrant, Weaviate, Milvus).

Cryptography#

The crypto vocabulary an operator should at least recognize. AES, ChaCha, AEAD, Diffie-Hellman, ECDH, the hash families, and the post-quantum candidates that have started shipping in real products.

AES#: Advanced Encryption Standard. Symmetric block cipher; FIPS 197.
Argon2 / scrypt / bcrypt#: Memory-hard password-hashing functions.
Ed25519 / X25519#: Edwards-curve signature scheme / X25519 ECDH key exchange. Modern defaults.
HMAC#: Hash-based Message Authentication Code.
KDF#: Key Derivation Function. Stretches a password / shared secret into one or more keys (PBKDF2, HKDF, Argon2).
ML-KEM / ML-DSA / SLH-DSA#: NIST post-quantum standards (FIPS 203 / 204 / 205, Aug 2024): Kyber-based KEM, Dilithium-based and SPHINCS+-based signatures.
Nonce / IV#: Number used once / Initialisation Vector. Unique per encryption to prevent ciphertext repetition.
Perfect Forward Secrecy#: Property that compromise of long-term keys does not compromise past session keys.
RSA#: Rivest-Shamir-Adleman. Classic public-key crypto; signing, encryption, key transport.
SHA-256 / SHA-3#: Secure Hash Algorithm 2 (FIPS 180-4) / 3 (FIPS 202).

Forensics#

The vocabulary around incident response and digital forensics. Chain of custody, indicators of compromise, timeline analysis, artifact types, and the analytical concepts that appear in any post-intrusion writeup.

Chain of custody#: Documented sequence of who handled evidence, when, where, and how. Preserves admissibility.
IOC / Indicator#: Indicator of Compromise. Hash, IP, domain, file path, regkey etc. tied to known-bad activity.
MFT#: Master File Table. NTFS metadata structure; records every file on the volume.
MISP#: Malware Information Sharing Platform. Open-source threat-intel sharing platform.
Sigma#: Vendor-neutral SIEM detection-rule format.
Slack space#: Unused bytes between the end of file content and the end of the cluster on disk; often holds remnants of prior data.
STIX / TAXII#: Structured Threat Information Expression / Trusted Automated Exchange of Indicator Information. CTI exchange standards.
Timeline analysis#: Reconstructing the order of events on a system from filesystem timestamps, journal records, and logs.
YARA#: Pattern-matching language for malware classification rules.

Systems Programming#

The low-level vocabulary engineers reach for around compilers, linkers, runtime systems, and the operating-system interface. ABI / API distinctions, calling conventions, JIT vs AOT, syscalls, and the memory-management terms that show up in reverse-engineering work.

ABI#: Application Binary Interface. Low-level contract between compiled units (calling convention, layout, syscalls).
AOT / JIT#: Ahead-of-Time / Just-in-Time compilation.
eBPF#: extended Berkeley Packet Filter. In-kernel sandboxed VM for running verified programs at hooks (network, syscall, tracing).
FFI#: Foreign Function Interface. Calling code written in another language.
GC#: Garbage Collection. Automatic memory reclamation.
MMIO#: Memory-Mapped I/O. Hardware registers exposed as memory addresses.
OOM#: Out Of Memory. The kernel kills a process when memory is exhausted (oom-killer).
RAII#: Resource Acquisition Is Initialisation. C++ / Rust idiom that ties resource lifetime to object lifetime.
Race condition#: Outcome depending on the unpredictable order of concurrent events.
Segfault#: Segmentation Fault. SIGSEGV: a process accessed an invalid address.
Syscall#: System call. The kernel-mode interface a userland program uses to ask the OS to do something.

RF and SDR#

The radio and software-defined-radio vocabulary the electronic-recon and wireless-recon pages assume. Bands and modulations, beaconing protocols (ADS-B, AIS, LoRa), the detection / collection terms (DF, TDOA), and the SDR hardware and software ecosystem.

ADC / DAC#: Analog-to-Digital / Digital-to-Analog Converter. The boundary between RF and digital baseband.
ADS-B#: Automatic Dependent Surveillance-Broadcast. 1090-MHz aircraft transponder beacon; the basis of OpenSky / FlightRadar.
AIS#: Automatic Identification System. VHF maritime vessel identification beacon.
GNSS#: Global Navigation Satellite System (GPS, GLONASS, Galileo, BeiDou). Position, navigation, timing.
IQ#: In-phase / Quadrature. Two orthogonal baseband channels that represent a complex-valued signal sampled by an SDR.
LNA / PA#: Low-Noise Amplifier / Power Amplifier. Receive-side and transmit-side gain stages.
OFDM#: Orthogonal Frequency-Division Multiplexing. Modulation behind Wi-Fi, LTE, 5G, DVB-T.
SDR#: Software-Defined Radio. RF front-end that hands IQ samples to software for demodulation and decoding.
SSB#: Single-Sideband. Bandwidth-efficient AM-derived voice modulation; common on HF.

Commands#

This handbook does not duplicate the per-command reference inside the glossary. The full A-Z command catalog (Debian-family Linux + Kali security tools, ~980 entries) lives in the per-letter pages A through Z. Topic-specific cheat sheets (linux, git, docker, kubectl, network, nmap) live alongside under the letter they start with.