Sycope dictionary

EU Regulation 2016/679 on personal data protection, in force since 25 May 2018. Sets out processing principles, lawful bases, people's rights and security obligations.

A data-driven method for finding the fundamental cause of a problem or incident, not just its symptoms, so the problem does not come back.

The maximum acceptable data loss measured in time after a failure — it sets how often backups and replication must run in a disaster recovery plan.

The maximum time to restore a system or process after a failure or incident before downtime starts to do harm. Set in the BIA and complemented by RPO.

The time from sending a packet to getting confirmation that it arrived. The basic measure of network latency, given in milliseconds.

Three cloud service models that differ in how much the provider manages: IaaS gives you infrastructure, PaaS a developer environment, and SaaS a ready-to-use app.

A category of tools that continuously check SaaS app settings via API and flag misconfigurations, overly broad permissions, and risky OAuth integrations.

Specialized infrastructure to which traffic is diverted during a DDoS attack (via BGP/DNS) to filter out malicious packets and send only clean traffic back to the origin.

An architecture model that converges networking (SD-WAN) and security (SWG, CASB, ZTNA, FWaaS) into one cloud-delivered service, with identity-based, Zero Trust access.

A network traffic monitoring method that samples packets on devices and sends the data to a collector for analysis. It is used to detect anomalies, threats, and usage patterns in real time.

Unauthorized apps or services used by employees without IT approval, often to get work done faster. They bypass official controls and can create security and compliance risks.

A cybersecurity system that provides real-time monitoring, analysis, and correlation of security events within a network infrastructure.

An Active Directory attack technique: the attacker forges a Kerberos service ticket (TGS) with a service account hash and bypasses the domain controller to reach a single service.

Slowloris is a denial-of-service attack that exhausts server resources by sending incomplete HTTP requests and holding connections open indefinitely.

A protocol used for managing and monitoring network devices such as routers, switches, servers.

Security Orchestration, Automation and Response (SOAR) is a cybersecurity platform that automates and coordinates security tasks. It helps teams detect, investigate, and respond to incidents faster.

A Security Operations Center is a team or facility that monitors, detects, and responds to cybersecurity threats in real time. Its purpose is to protect systems, data, and operations.

A machine-readable list of all components, libraries and dependencies that make up software, with their versions, origin and licenses. The basis for managing supply-chain risk.

A method of monitoring network traffic that copies network packets from selected ports to a monitoring port.

Targeted phishing attack using personalized messages to impersonate trusted sources and trick specific individuals into revealing credentials.

A code-injection attack that inserts malicious SQL into input fields to manipulate database queries. It can expose, alter, or delete data by exploiting unsafe query handling.

Open OASIS standard for describing cyber threats in JSON: typed objects (SDO/SCO/SRO) and their relationships, used to exchange threat intelligence.

Unauthorized takeover of a subdomain allowing attackers to redirect users to malicious content or steal data.

A cyberattack that compromises a trusted supplier or service provider to reach its customers. It exploits that trust to insert malicious code or access into the target organization.

DDoS attack using fake SYN packets to exhaust server resources and prevent legitimate connections.

A standard and protocol for sending system event messages from devices and applications to a central collector; each entry encodes the source (facility) and importance (severity).

A hardware device used to capture and monitor network traffic, allowing troubleshooting, analysing performance, and enhancing security.

Open OASIS standard for automatically exchanging cyber threat intelligence (CTI) over REST/HTTPS; delivers STIX data using collections (pull) and channels (push).

A reliable, ordered, and error-checked data transmission method, essential for web browsing, email, and file transfers.

The amount of data actually transferred across a network per unit of time (bps); lower than a link's theoretical capacity because of overhead, latency, and packet loss.

TLS/SSL is a security protocol that encrypts data between a user’s browser and a website. It helps protect information from interception and verifies the site’s identity.

Hosts, applications, or conversations that generate the most network traffic; identified from flow data such as NetFlow, IPFIX, and sFlow.

Tactics, Techniques, and Procedures — a description of how an attacker operates across three levels (goal, method, execution), used in MITRE ATT&CK, threat hunting, and attribution.

UDP Flood is a DDoS attack that overwhelms servers with massive numbers of useless UDP packets, causing service disruption and downtime.

A fast and connectionless communication method used for transmitting data without guarantees of delivery or order.

Behavior analytics that uses AI and machine learning to detect unusual activity by users and systems in an IT environment. It helps identify threats such as account compromise, insider misuse, and data theft.

Awareness of everything that is on and transfer within the IT network, allowing you supervision of network traffic, performance and security

Logical Layer 2 split of a network into separate broadcast domains, regardless of where devices physically sit; frames are tagged per IEEE 802.1Q, and traffic between VLANs needs Layer 3 routing.

A cyberattack flooding a network with massive traffic volumes to overwhelm servers and render services unavailable, prioritizing disruption over data theft.

A virtual private network that encrypts internet traffic and masks your IP address to improve privacy and security online.

A web application firewall monitors and filters traffic to a web application. It blocks suspicious requests to help prevent attacks such as SQL injection and cross-site scripting.

Deploying malicious scripts, pose security risks, enabling unauthorized access, data theft, and service disruptions.

XDR is a security platform that combines data from multiple sources to detect and investigate threats. It helps automate response and provides centralized visibility across an organization.

A web vulnerability where attackers inject malicious code into pages viewed by others. It can steal data, hijack sessions, or alter site behavior.

A security model that requires strict identity verification and continuous monitoring, assuming no user or device is trusted by default.

Code or technique that abuses a flaw the vendor does not know about, with no patch yet — the attack happens before the flaw is disclosed and fixed.