Security terms, explained plainly
CVE (Common Vulnerabilities and Exposures)
A standardized identifier assigned to a publicly disclosed cybersecurity vulnerability.
CVSS (Common Vulnerability Scoring System)
A numeric scale from 0-10 used to convey the severity of a vulnerability.
Vulnerability Scanning
Automated testing of systems to identify known security weaknesses.
Penetration Testing
Authorized, simulated attacks performed by a human tester to find exploitable weaknesses.
Red Team vs. Blue Team
Red teams simulate attackers; blue teams defend. Purple teaming blends the two.
Zero-Day Vulnerability
A vulnerability unknown to the vendor, with no available patch, at the time it is discovered or exploited.
Attack Surface
The total set of points where an unauthorized user could try to enter or extract data from a system.
OWASP Top 10
A regularly updated list of the most critical web application security risks, maintained by OWASP.
SIEM (Security Information and Event Management)
A system that aggregates and correlates security event data across an organization for detection and response.
SOC 2
An auditing framework assessing a service organization's controls around security, availability, and related trust principles.
PCI DSS
The Payment Card Industry Data Security Standard, a mandatory framework for any organization handling card payments.
Patch Management
The process of identifying, testing, and deploying software updates that fix known vulnerabilities.