Ethical Hacking Terminologies: Essential Cybersecurity Glossary

A threat is any potential danger that could exploit a vulnerability to cause harm. Threats can be natural (earthquakes, floods), human (hackers, disgruntled employees), or environmental (power failures). In cybersecurity, we primarily focus on human-originated threats.

A vulnerability is a weakness in a system, application, or process that can be exploited by a threat. Vulnerabilities arise from software bugs, misconfigurations, design flaws, or human errors. Examples include unpatched software, weak passwords, and open ports.

Risk is the potential for loss or damage when a threat exploits a vulnerability. Risk is typically calculated as Risk = Threat × Vulnerability × Impact. Security professionals prioritize risks based on their likelihood and potential business impact.

An exploit is a piece of code, technique, or method that takes advantage of a vulnerability to cause unintended behavior. Exploits can be publicly known (with available patches) or zero-day (unknown to the vendor and without a fix).

An attack vector is the path or method an attacker uses to gain access to a target system. Common attack vectors include phishing emails, malicious websites, unpatched software, misconfigured cloud services, USB drives, and unsecured Wi-Fi networks.

The attack surface is the total sum of all possible entry points that an attacker could use. A larger attack surface means more potential vulnerabilities. Reducing the attack surface — by closing unnecessary ports, removing unused software, and limiting user privileges — is a fundamental security practice.

A payload is the component of an attack that performs the actual malicious action. For example, in a malware attack, the exploit is the code that breaches the system, while the payload might be a ransomware encryptor, a keylogger, or a reverse shell.

A zero-day vulnerability is a flaw unknown to the software vendor, meaning no patch exists. Zero-day exploits are extremely valuable — they can sell for hundreds of thousands of dollars on the black market and are prized by intelligence agencies and advanced threat actors.

A firewall is a network security device that monitors and filters incoming and outgoing traffic based on predefined rules. Firewalls can be hardware-based, software-based, or cloud-based, and they form the first line of defense for most networks.

An Intrusion Detection System (IDS) monitors network traffic for suspicious activity and alerts administrators. An Intrusion Prevention System (IPS) goes further by automatically blocking detected threats. Both can be network-based (NIDS/NIPS) or host-based (HIDS/HIPS).

A VPN (Virtual Private Network) creates an encrypted tunnel between two points on a network, protecting data in transit from eavesdropping. VPNs are essential for secure remote access and for hiding network traffic from potential attackers.

Encryption transforms readable data (plaintext) into an unreadable format (ciphertext) using an algorithm and a key. Symmetric encryption (AES) uses the same key for encryption and decryption, while asymmetric encryption (RSA) uses a public-private key pair.

A backdoor is a hidden method of bypassing normal authentication to access a system. Backdoors can be intentionally installed by developers for maintenance or secretly planted by attackers to maintain persistent access after an initial compromise.

A rootkit is a collection of malicious tools designed to gain administrator-level (root) access to a system while remaining undetected. Rootkits can operate at the firmware, bootloader, kernel, or application level, with deeper rootkits being harder to detect and remove.

A botnet is a network of compromised computers (bots or zombies) controlled by an attacker. Botnets are used for distributed denial-of-service (DDoS) attacks, spam campaigns, cryptocurrency mining, and credential stuffing attacks. Some botnets contain millions of infected devices.

Privilege escalation is the act of exploiting a vulnerability to gain elevated access beyond what was originally authorized. Vertical escalation means gaining higher privileges (user to admin), while horizontal escalation means accessing another user's resources at the same privilege level.