Foundation vocabulary
31 core terms in simple English — with day-to-day examples from Gmail, PhonePe/Paytm/GPay, Instagram, LinkedIn, college portals, offices, and payment gateways. Pictures + quizzes so it sticks.
Three goals: keep data secret, correct, and working when needed.
Technical: Confidentiality, Integrity, Availability.
Classic example: Encrypt DB (C); checksums (I); redundant servers (A).
Daily life: Gmail privacy (C), correct PhonePe amount (I), college portal up on results day (A).
Something valuable you protect.
Technical: People, data, systems, reputation, or processes with value.
Classic example: Customer PII database, source code, domain admin.
Daily life: Your Instagram account, UPI wallet, exam PDFs, company Slack.
Anything that can harm an asset.
Technical: Potential cause of an unwanted incident.
Classic example: Ransomware gang, insider abuse, flood in a datacenter.
Daily life: Fake Paytm SMS, romance scammer on a dating app, ransomware on a clinic PC.
A weakness a threat can use.
Technical: Flaw in software, config, process, or people.
Classic example: Unpatched VPN, default password, missing MFA.
Daily life: No MFA on Gmail; shared Razorpay admin login; outdated phone OS.
Chance of harm × how bad it would be.
Technical: Likelihood × impact, reduced by controls.
Classic example: Public RDP without MFA on finance server = high risk.
Daily life: Reused banking password on a gaming site after that site is breached.
Something that reduces risk.
Technical: Preventive, detective, or corrective measures.
Classic example: Firewall (preventive), SIEM alert (detective), restore backup (corrective).
Daily life: Phone lock screen, MFA, app updates, verified backups of project files.
Fake messages that trick you into giving secrets.
Technical: Social engineering via email/SMS/voice/DMs.
Classic example: Fake payroll reset on lookalike domain.
Daily life: Fake UPI KYC SMS; fake Instagram ‘you won’ DM; fake LinkedIn job form.
Proving who you are.
Technical: Verify identity via knowledge / possession / inherence.
Classic example: Password + TOTP MFA.
Daily life: Fingerprint to open PhonePe; Google login to Gmail.
What you may do after login.
Technical: Roles, attributes, resource permissions.
Classic example: Read invoices but not approve payments.
Daily life: Student sees own marks only; Drive ‘view’ vs ‘edit’.
Password plus another proof.
Technical: Multi-factor: know / have / are.
Classic example: Password + authenticator TOTP.
Daily life: Instagram 2FA, Google prompt, bank OTP — protect email first.
Only the access needed for the job.
Technical: Minimize permissions of users, services, tokens.
Classic example: CI gets s3:GetObject on one prefix, not s3:*.
Daily life: Intern gets CRM read-only — not Cashfree full admin.
Many layers so one failure is not total failure.
Technical: Stack controls across network, host, identity, app, data.
Classic example: WAF + parameterized queries + least-privilege DB user.
Daily life: Door lock + CCTV + alarm — same idea for Gmail MFA + anti-phishing + backups.
Do not trust just because someone is ‘on the office Wi‑Fi’.
Technical: Continuous verify, least privilege, assume breach.
Classic example: SSO + device check before app access even on VPN.
Daily life: Company laptop must pass health check before opening HR portal.
How attackers behave — their playbook.
Technical: Tactics, Techniques, Procedures (often MITRE ATT&CK).
Classic example: T1110 brute force; T1059 scripting.
Daily life: Same gang always sends ‘KYC expire’ SMS then asks OTP — that pattern is a TTP.
A clue that something bad happened.
Technical: Hash, IP, domain, email indicator.
Classic example: Malware SHA-256, C2 domain.
Daily life: A known bad link domain showing up in your Gmail quarantine.
Moving sideways across computers after entry.
Technical: Use creds/remote services to new hosts.
Classic example: Pass-the-hash to another PC.
Daily life: Attacker gets one office laptop, then reaches the file server with shared marks.
Central security camera room for logs and alerts.
Technical: Collect, normalize, correlate, alert.
Classic example: Failed logons + odd geo → high-priority case.
Daily life: Like a mall security desk watching many camera feeds at once — for IT logs.
Security camera + guard on each laptop/server.
Technical: Endpoint detection and response telemetry.
Classic example: Odd PowerShell → isolate host.
Daily life: Company laptop agent that can freeze a PC if ransomware starts.
A calm plan when something goes wrong.
Technical: Prepare → detect → contain → eradicate → recover → lessons.
Classic example: Ransomware playbook with comms + restore.
Daily life: Lost phone checklist: lock account, revoke sessions, call bank — personal IR.
Close extra doors attackers love.
Technical: Disable unused services, patch, secure baselines.
Classic example: Disable SMBv1; MFA; close unused ports.
Daily life: Remove unused Chrome extensions; turn off USB autorun; update phone.
Getting more power than you started with.
Technical: Vertical or horizontal privilege gain.
Classic example: Weak service ACL → SYSTEM.
Daily life: Intern account somehow reaches payroll admin screens — that is a bug / abuse path.
Updating software safely and on time.
Technical: Inventory, prioritize, test, deploy, verify.
Classic example: Emergency VPN patch after active exploit.
Daily life: Phone OS update that fixes a WhatsApp bug — click install.
Write down what happened; watch for weird patterns.
Technical: Centralize auth/process/network/cloud audits.
Classic example: Impossible travel + failed MFA alert.
Daily life: Gmail ‘security activity’ list; bank SMS for every login — personal mini-monitoring.
Common web app risk list developers must know.
Technical: Consensus critical web risks (updates over time).
Classic example: Injection, broken access control, SSRF…
Daily life: Why your college portal must not show another student’s fees if you change an ID in the URL.
Risk from code and vendors you did not write.
Technical: Dependencies, build systems, hardware, third parties.
Classic example: Malicious npm package in CI.
Daily life: Random ‘mod APK’ or shady Chrome extension in your browser.
A severity score for a software weakness.
Technical: Common Vulnerability Scoring System — technical severity.
Classic example: Remote unauth RCE often Critical.
Daily life: Helps IT decide: patch the VPN appliance tonight vs next month.
Cloud company secures the building; you secure your rooms and keys.
Technical: Split varies by IaaS/PaaS/SaaS.
Classic example: AWS runs hypervisor; you patch guest OS and bucket policies.
Daily life: Gmail secures servers; you still need a strong password + MFA.
Door number for a service on a device.
Technical: TCP/UDP 0–65535.
Classic example: 443 HTTPS, 22 SSH, 53 DNS.
Daily life: Your phone uses 443 for almost every app API (Instagram, Gmail, UPI backends).
Phonebook of the internet.
Technical: Name → A/AAAA/MX/TXT records.
Classic example: example.com → IP.
Daily life: Typing phonepe.com finds the real servers — fake DNS/Wi‑Fi can mislead you.
Gate that allows or blocks traffic.
Technical: Policy on ports, IPs, apps, identities.
Classic example: Block inbound 3389 from internet.
Daily life: Home router + phone OS permissions + cloud security groups.
Fingerprint vs secret lockbox.
Technical: Hashes verify integrity; encryption needs keys for confidentiality.
Classic example: SHA-256 checksum vs AES disk encryption.
Daily life: WhatsApp encryption vs storing password hashes (not plain passwords) on servers.
Practice in Quizzes and Labs. Never test real payment apps or college portals without written permission.