Cybersecurity Glossary

A data center component that manages application traffic, balances load, and secures it.

A sophisticated, persistent attack type usually carried out by state-sponsored or organized groups, aiming to remain undetected in a network for a long time.

The sum of all entry points (systems, applications, users) an attacker could use to breach a system.

A targeted email attack in which the attacker impersonates an executive or business partner to trick employees into unauthorized money transfers or data sharing.

The protocol that forms the backbone of the internet, enabling the exchange of routing information between different autonomous systems.

An intermediary layer that enforces security policies between an organization and cloud service providers, giving visibility into cloud application usage.

A cloud-native application protection approach that secures cloud workloads, containers, and infrastructure from code to runtime on a single platform.

A publicly available vulnerability catalog, now an industry standard, that assigns a unique identifier to known security vulnerabilities.

A standard scoring system, used for prioritization, that expresses the severity of a security vulnerability on a scale of 0-10.

A distributed attack type that aims to take a system offline by flooding it with more traffic than it can normally handle.

The strategy and set of processes aimed at restoring IT systems and data to predefined targets (RTO/RPO) after a disaster.

Technologies and processes aimed at preventing sensitive data from leaving the organization without authorization.

The Digital Operational Resilience Act that regulates IT risk management, incident reporting, and third-party risk management for EU financial institutions.

A security solution that detects suspicious behavior at endpoints and offers automated or semi-automated response capability.

The European Union's comprehensive regulation on the processing and protection of personal data.

A redundant architecture design principle that ensures systems continue operating without interruption even if a component fails.

Dedicated hardware that generates, stores, and protects cryptographic keys at the hardware level, providing the highest level of security.

Systems that analyze network traffic against known attack signatures and abnormal behavior to detect (IDS) or directly block (IPS) threats.

An internationally recognized standard for information security management systems.

A secure electronic mail system, used in official correspondence, where the moment of sending and delivery can be legally proven.

Turkey's Law on the Protection of Personal Data, which regulates the procedures and principles for processing and protecting personal data in Turkey.

A method that distributes incoming traffic across multiple servers, both improving performance and preventing a single server from becoming overloaded.

The transfer of IT and security infrastructure operations to an expert external provider for a fixed fee.

A solution that provides security policies, application distribution, and remote management for corporate or BYOD mobile devices.

The delivery of threat detection and response capabilities as a continuously monitored service provided by an expert team.

A security method that requires a user to prove their identity not only with a password but also with an additional verification factor (SMS, app, biometric).

A protocol used in traditional corporate WAN connections that routes data packets quickly and predictably via labels.

A control mechanism that verifies the identity and security posture of every device connecting to the network, allowing access only to compliant devices.

Executing network device configuration, monitoring, and troubleshooting processes through automation tools instead of manual intervention.

Systems that combine advanced capabilities such as application awareness, threat intelligence, and deep packet inspection with classic firewall functions.

Two cost models frequently used in IT budgeting: OPEX refers to recurring operating expenses, while CAPEX refers to one-time capital investments.

A specialized approach that protects industrial control systems and operational technology (OT) environments from threats that classic IT security tools cannot see.

A security discipline in which the access of administrator and privileged accounts is strictly controlled, monitored, and logged.

An international payment card security standard applicable to organizations that process, transmit, or store card data.

A test method that verifies the exploitability of vulnerabilities by attempting to breach systems, with authorization, from a real attacker's perspective.

A social engineering attack, usually carried out via email, aimed at tricking users into stealing credentials or sensitive data.

Infrastructure that provides secure communication and authentication through digital certificates and public/private key pairs.

An attack type that aims to inject malicious commands into an AI model, causing it to leak sensitive data or perform unauthorized actions.

A traffic management mechanism that guarantees the performance of critical application traffic by prioritizing it even during network congestion.

A type of malicious software that encrypts a victim's data, making it inaccessible, and demands a ransom in exchange for decryption.

The Red Team takes on the attacker role and tests the organization, while the Blue Team represents the defense side that detects and responds to these attacks.

The target that defines the maximum acceptable data loss period in a disaster scenario.

The maximum targeted time for restoring a system in a disaster scenario.

A security testing environment where a suspicious file or code is run in an isolated area to analyze its behavior without risking the production environment.

A user- and application-centric access architecture that combines network and security functions on a single cloud-based platform.

Complementary test methods that analyze application source code (SAST), the running application (DAST), or the open-source components used (SCA) for security vulnerabilities.

Software-defined wide area network; technology that manages inter-branch connectivity through centralized, application-aware policies.

A platform that detects security events by centrally collecting and correlating log and event data across the organization.

A communication protocol that enables the establishment, management, and termination of voice and video call sessions.

A contract that defines the service quality levels (response time, uptime, etc.) committed to by a service provider.

A platform that accelerates response to security events through automation and predefined workflows, reducing the manual burden on teams.

The central operations unit that monitors, analyzes, and responds to the organization's security events around the clock.

A modern two-tier switching topology used in data center networks that provides low latency and high scalability.

A sign-on method that allows a user to access multiple applications and systems with a single authentication.

The Customer Security Programme, a security control framework that financial institutions connected to the SWIFT network must comply with.

Using information collected and analyzed about current attacker tactics, techniques, and indicators to make defense proactive.

The unification of communication tools such as voice/video calls, instant messaging, and file sharing on a single platform.

A solution that enables all endpoints across different operating systems to be managed from a single platform.

A method of logically dividing a physical network into multiple independent networks for traffic isolation and security purposes.

Technology that enables voice calls to be transmitted over the internet protocol instead of traditional telephone lines.

A security layer that detects and blocks application-layer attacks such as SQL injection and XSS targeting web applications.

An approach that provides broader and more contextual threat detection by unifying endpoint, network, cloud, and identity data.

A security model based on the principle that no user or device is trusted by default, and every access is continuously verified based on identity and context.

An automation method that enables a new network device to be automatically added to the network and brought into service without manual configuration.