Cybersecurity acronyms glossary

Security exams assume you speak the alphabet soup fluently. These are the core acronyms that recur across all 11 certifications on this site, each expanded and explained in one plain line. Search for the one that just stopped you mid-question.

Search acronyms or meanings

Acronym	Stands for	What it means
AAA	Authentication, Authorization, and Accounting	Proves who you are, decides what you can do, and logs what you did.
ACL	Access Control List	Rules on a router or firewall that permit or deny traffic.
AES	Advanced Encryption Standard	The symmetric encryption standard used nearly everywhere.
AH	Authentication Header	The IPsec protocol that gives integrity and authentication, but no encryption.
AP	Access Point	The device that lets wireless clients join a wired network.
APT	Advanced Persistent Threat	A well resourced attacker who gets in and stays in for a long time.
ARP	Address Resolution Protocol	Maps IP addresses to MAC addresses on a local network.
ASLR	Address Space Layout Randomization	Shuffles memory locations so exploits cannot predict where code lands.
BCP	Business Continuity Plan	The plan for keeping the business running during a disruption.
BEC	Business Email Compromise	Fraud where attackers impersonate executives or vendors to move money.
BYOD	Bring Your Own Device	Employees using personal phones and laptops for work.
CA	Certificate Authority	The trusted issuer that signs digital certificates.
CASB	Cloud Access Security Broker	A control point that enforces security policy for cloud apps.
CIA	Confidentiality, Integrity, Availability	The triad: the three goals every security control exists to protect.
CIS	Center for Internet Security	Publisher of the CIS Controls and the hardening benchmarks.
CISO	Chief Information Security Officer	The executive who owns the security program.
CRL	Certificate Revocation List	A signed list of certificates that are no longer trusted.
CSRF	Cross-Site Request Forgery	Tricks a logged-in browser into sending requests the user never intended.
CVE	Common Vulnerabilities and Exposures	The public catalog that gives each known flaw its own ID.
CVSS	Common Vulnerability Scoring System	Scores how severe a vulnerability is, from 0 to 10.
DAC	Discretionary Access Control	Resource owners decide for themselves who gets access.
DDoS	Distributed Denial of Service	Many machines flood a target at once to knock it offline.
DES	Data Encryption Standard	The retired symmetric cipher, now far too weak to use.
DHCP	Dynamic Host Configuration Protocol	Hands out IP addresses and network settings automatically.
DKIM	DomainKeys Identified Mail	Signs outgoing email so receivers can verify it was not altered.
DLP	Data Loss Prevention	Tools that watch for sensitive data leaving the organization.
DMARC	Domain-based Message Authentication, Reporting, and Conformance	The email policy that tells receivers what to do with spoofed mail.
DMZ	Demilitarized Zone	A screened subnet that hosts public facing services.
DNS	Domain Name System	Translates names like quizsec.com into IP addresses.
DNSSEC	Domain Name System Security Extensions	Signs DNS records so the answers can be verified.
DoS	Denial of Service	A single source floods a target to make it unavailable.
DRP	Disaster Recovery Plan	The plan for restoring IT systems after a major incident.
EAP	Extensible Authentication Protocol	The framework behind most Wi-Fi and 802.1X logins.
ECC	Elliptic Curve Cryptography	Public key crypto that delivers strong security with short keys.
EDR	Endpoint Detection and Response	Watches endpoints for malicious behavior and helps you respond.
ESP	Encapsulating Security Payload	The IPsec protocol that encrypts the data itself.
FIM	File Integrity Monitoring	Alerts when important files change unexpectedly.
GDPR	General Data Protection Regulation	The EU privacy law with heavy fines for mishandling personal data.
GRE	Generic Routing Encapsulation	A tunnel that carries one network protocol inside another.
HIDS	Host-based Intrusion Detection System	Detection software that runs on a single machine.
HIPS	Host-based Intrusion Prevention System	Like a HIDS, except it can also block what it catches.
HMAC	Hash-based Message Authentication Code	A keyed hash that proves a message is authentic and unchanged.
IAM	Identity and Access Management	The systems and policies that control who can access what.
ICMP	Internet Control Message Protocol	Carries error and control messages. Ping uses it.
IDS	Intrusion Detection System	Watches traffic or systems and alerts on suspicious activity.
IOC	Indicator of Compromise	A clue, like a bad file hash or IP address, that a breach happened.
IPsec	Internet Protocol Security	The suite that encrypts and authenticates IP traffic, and the backbone of most VPNs.
IPS	Intrusion Prevention System	An IDS that can also block the traffic it flags.
IR	Incident Response	The process of detecting, containing, and recovering from attacks.
LDAP	Lightweight Directory Access Protocol	Queries directory services such as Active Directory.
MAC	Mandatory Access Control	Access decided by labels and clearances, not by owners. It also means Media Access Control, the hardware address of a network card.
MFA	Multifactor Authentication	Login proof from two or more categories: something you know, have, or are.
MITM	Man-in-the-Middle	An attacker secretly relays traffic between two parties. Now often called adversary in the middle.
NAC	Network Access Control	Checks a device's health and identity before letting it on the network.
NAT	Network Address Translation	Lets many private IP addresses share one public address.
NDA	Non-Disclosure Agreement	A contract that keeps shared information confidential.
NIDS	Network-based Intrusion Detection System	Detection that watches traffic across a network segment.
NIST	National Institute of Standards and Technology	The US body behind the Cybersecurity Framework and the 800 series guides.
OCSP	Online Certificate Status Protocol	Checks in real time whether a certificate has been revoked.
OSINT	Open Source Intelligence	Intelligence gathered entirely from public sources.
OTP	One-Time Password	A code valid for a single login, often from an authenticator app.
PAM	Privileged Access Management	Controls, vaults, and audits admin and other high power accounts.
PCI DSS	Payment Card Industry Data Security Standard	The security standard for anyone who handles card payments.
PGP	Pretty Good Privacy	A long standing standard for encrypting email and files.
PHI	Protected Health Information	Health data that HIPAA protects.
PII	Personally Identifiable Information	Data that can identify a specific person.
PKI	Public Key Infrastructure	The whole system of keys, certificates, and authorities standing behind TLS.
RADIUS	Remote Authentication Dial-In User Service	Central authentication for network access, usually on UDP 1812 and 1813.
RBAC	Role-Based Access Control	Permissions assigned by job role instead of person by person.
RDP	Remote Desktop Protocol	Microsoft's remote access protocol, on port 3389.
RPO	Recovery Point Objective	How much data you can afford to lose, measured in time.
RTO	Recovery Time Objective	How quickly you must be back up after an outage.
SAML	Security Assertion Markup Language	The XML based standard behind a lot of single sign-on.
SDLC	Software Development Life Cycle	The phases of building software, ideally with security in every one.
SIEM	Security Information and Event Management	Collects logs from everywhere and correlates them into alerts.
SLA	Service-Level Agreement	The promised level of service, usually including uptime and response times.
SMB	Server Message Block	The Windows file sharing protocol, on port 445.
SNMP	Simple Network Management Protocol	Monitors and manages network devices. Use version 3 for encryption.
SOAR	Security Orchestration, Automation, and Response	Automates security workflows and response playbooks.
SOC	Security Operations Center	The team that monitors for attacks around the clock.
SPF	Sender Policy Framework	A DNS record listing which servers may send mail for a domain.
SQLi	SQL Injection	Attacker input that changes what a database query does.
SSH	Secure Shell	Encrypted remote administration, on port 22.
SSL	Secure Sockets Layer	The retired predecessor of TLS. People still say it out of habit.
SSO	Single Sign-On	One login that unlocks many applications.
TACACS+	Terminal Access Controller Access-Control System Plus	Cisco's AAA protocol for administering network devices, on TCP 49.
TLS	Transport Layer Security	Encrypts traffic in transit. It is what HTTPS actually uses.
TOTP	Time-based One-Time Password	The rotating 30 second codes from authenticator apps.
TTP	Tactics, Techniques, and Procedures	How an attacker behaves, from broad strategy down to specific steps.
UEBA	User and Entity Behavior Analytics	Flags accounts and devices that start acting strangely.
VLAN	Virtual Local Area Network	Logically segments a network without separate hardware.
VPN	Virtual Private Network	An encrypted tunnel across an untrusted network.
WAF	Web Application Firewall	Filters web traffic to protect apps from attacks like SQL injection.
WPA	Wi-Fi Protected Access	The family of Wi-Fi security standards. WPA3 is the current generation.
XDR	Extended Detection and Response	Correlates detection across endpoints, network, cloud, and email.
XSS	Cross-Site Scripting	Injecting malicious script into pages that other users view.
ZTNA	Zero Trust Network Access	Grants access to one app at a time after verifying identity and device, never broad network trust.
No acronym matches that search. Try the letters themselves, or a word from the meaning.

Study tip: the pairs are what exams actually test. IDS detects, IPS prevents. HIDS watches one host, NIDS watches the wire. RPO is about data, RTO is about time. Learn them as contrasts and half the acronym questions answer themselves.

More cheat sheets

Common ports

The ports Security+, Network+, and CCNA expect you to know cold, with the one fact that matters for each.

Open the ports cheat sheet →

The OSI model

All seven layers, the mnemonic, the TCP/IP mapping, and the facts exams love to test.

Review the OSI model →

Which cert should you take?

Five questions, one recommendation. Match the cert to your experience and your goal.

Take the cert finder →

Acronyms are baked into every practice question here. Premium unlocks all 2,200 of them.

Go Premium: $12/year