CEH Acronym Glossary

A single-page reference of the acronyms that appear in the CEH v13 exam kit (Domains 1-4 + tools/labs/methodology). Each entry is an acronym, its expanded form, and a one-line definition (≤ 12 words) for fast memorisation.

How to use this file: Skim the categorised sections to learn by topic; jump to the alphabetical index at the bottom to look up any single acronym during revision.

1. Threats & Attack Types

APT - Advanced Persistent Threat. Long-dwell, often state-sponsored attacker with custom tooling and zero-days.

BEC - Business Email Compromise. Fraud that impersonates an executive to trick finance into wiring money.

BFA - Brute Force Attack. Exhaustive trial of every possible password, key, or token until one matches.

C2 - Command and Control. Attacker infrastructure that beacons compromised hosts for instructions and payload updates.

CSRF - Cross-Site Request Forgery. Forged request that re-uses an authenticated victim’s session cookie.

CVSS - Common Vulnerability Scoring System. FIRST’s 0.0-10.0 severity score; Base + Threat + Environmental + Supplemental.

CVE - Common Vulnerabilities and Exposures. MITRE-assigned unique ID for a single publicly disclosed vulnerability.

CWE - Common Weakness Enumeration. MITRE’s taxonomy of software weakness types; CVE is the instance.

DDoS - Distributed Denial of Service. Many sources flood a target to exhaust bandwidth, state, or app resources.

DoS - Denial of Service. Single-source attack exhausting a target’s resources so users can’t reach it.

LLMNR - Link-Local Multicast Name Resolution. Windows multicast resolver; Responder poisons it for hashes.

OWASP - Open Worldwide Application Security Project. Publishes the Top 10, ASVS, WSTG, and Cheat Sheet Series.

RCE - Remote Code Execution. Vulnerability class where attacker code runs on the target under its privileges.

ROP - Return-Oriented Programming. Code-reuse exploit chaining gadgets from existing binaries to bypass DEP.

SSRF - Server-Side Request Forgery. Server tricked into making a request to an internal resource.

XSS - Cross-Site Scripting. Injecting JavaScript into a victim page to steal cookies or session.

XXE - XML External Entity. XML parser loads external entities and reads local files or SSRF-internal endpoints.

2. Defense & Architecture

AAA - Authentication, Authorization, and Accounting. Trio of access-control services: identity, permission, audit.

ACL - Access Control List. Ordered rules permitting or denying traffic by IP, port, protocol, or user.

AV - Antivirus. Signature (and increasingly behavioural) engine that detects and removes known malware.

EDR - Endpoint Detection and Response. Continuous endpoint telemetry, behavioural detection, hunt, and remote response.

HIDS - Host Intrusion Detection System. Detects suspicious activity on a single host via logs and integrity checks.

HSM - Hardware Security Module. Tamper-resistant appliance that generates, stores, and uses cryptographic keys.

IAM - Identity and Access Management. Policies, roles, and lifecycle for who can access what resource, when.

IDS - Intrusion Detection System. Passive sensor comparing traffic or host events to signatures and anomalies.

IPS - Intrusion Prevention System. Inline sensor that drops or resets traffic matching signatures or anomalies.

IR - Incident Response. Documented process - detect, contain, eradicate, recover, learn - for confirmed events.

MFA - Multi-Factor Authentication. Two or more of: knowledge, possession, inherence - defeats password-only compromise.

NAC - Network Access Control. Posture-checks a device (auth, AV, patch) before granting 802.1X-validated LAN access.

NGFW - Next-Generation Firewall. Stateful + DPI + IPS + app awareness; modern enterprise perimeter default.

RASP - Runtime Application Self-Protection. Library inside the app that hooks requests and blocks injection in-process.

RBAC - Role-Based Access Control. Permissions are assigned to roles; users inherit role permissions on assignment.

SIEM - Security Information & Event Management. Centralises logs, correlates events, and emits alerts for analysts.

SOAR - Security Orchestration, Automation & Response. Playbook-driven actions on SIEM alerts to enrich and respond.

SOC - Security Operations Center. People + process + tooling that monitor, triage, and respond 24×7.

WAF - Web Application Firewall. Layer-7 reverse proxy that inspects HTTP/SQL/XML against the OWASP Top 10.

XDR - Extended Detection & Response. EDR plus email, identity, cloud, network correlated into a single incident.

3. Cryptography

AES - Advanced Encryption Standard. NIST FIPS 197 symmetric block cipher; 128/192/256-bit keys, SPN structure.

CA - Certificate Authority. Trusted entity that issues and signs X.509 certificates binding keys to identities.

CBC - Cipher Block Chaining. Block mode that XORs each plaintext block with the previous ciphertext block.

CRL - Certificate Revocation List. CA-signed list of certificate serial numbers that have been revoked.

CTR - Counter Mode. Turns a block cipher into a stream by encrypting successive counters.

DH - Diffie-Hellman. Key-agreement protocol; both sides derive a shared secret over an insecure channel.

ECC - Elliptic Curve Cryptography. Asymmetric scheme giving equivalent security to RSA at smaller keys.

ECDH - Elliptic Curve Diffie-Hellman. DH key agreement performed on an elliptic curve group; small and fast.

ECDSA - Elliptic Curve Digital Signature Algorithm. NIST-standard elliptic-curve signature scheme (Bitcoin, TLS).

GCM - Galois/Counter Mode. AEAD block mode - CTR encryption with a polynomial-based GHASH authentication tag.

HMAC - Hash-based Message Authentication Code. MAC = Hash((key ⊕ opad) ‖ Hash((key ⊕ ipad) ‖ msg)).

IV - Initialization Vector. Random nonce that seeds a cipher mode; identical plaintexts encrypt differently.

MD5 - Message Digest 5. 128-bit hash; collisions are trivial - do not use.

OCSP - Online Certificate Status Check. Real-time query to the CA to confirm a certificate is not revoked.

PGP - Pretty Good Privacy. OpenPGP hybrid encryption and web-of-trust signing used for email and files.

PKI - Public Key Infrastructure. Hierarchy of CAs, certificates, CRLs, and OCSP that binds keys to identities.

RSA - Rivest-Shamir-Adleman. Asymmetric cipher for key transport and signatures; ≥ 2048-bit modulus recommended.

S/MIME - Secure / Multipurpose Internet Mail Extensions. X.509-signed and encrypted email standard (corporate).

SHA - Secure Hash Algorithm. NIST hash family: SHA-1 (broken), SHA-2 (256/384/512), SHA-3 (Keccak sponge).

X.509 - ITU-T Standard for Public Key Certificates. The certificate format used by TLS, S/MIME, code signing.

4. Compliance & Frameworks

CCPA - California Consumer Privacy Act. California state privacy law granting consumers access, deletion, opt-out.

CIS - Center for Internet Security. Publishes the CIS Controls and CIS Benchmarks (hardening guides per platform).

CMMC - Cybersecurity Maturity Model Certification. DoD framework L1-L3 requiring assessment for defence contractors.

CSA - Cloud Security Alliance. Body that publishes the Cloud Controls Matrix (CCM) and the STAR registry.

GDPR - General Data Protection Regulation. EU regulation on personal-data processing, breach notification, DPIA.

HIPAA - Health Insurance Portability and Accountability Act. US healthcare law with Security, Privacy, Breach rules.

ISO - International Organization for Standardization. Publishes ISO/IEC 27001 (ISMS), 27002 (controls), 27005 (risk).

MITRE - Not-for-profit that maintains CVE, CWE, ATT&CK, and the Diamond Model of intrusion analysis.

NIST - National Institute of Standards and Technology. US body publishing CSF, SP 800-53, SP 800-115, and FIPS.

PCI DSS - Payment Card Industry Data Security Standard. Mandatory controls for entities storing or processing card data.

PDPA - Personal Data Protection Act. Singapore’s privacy law - Protection, Retention, Breach Notification.

SOX - Sarbanes-Oxley Act. US financial-reporting law mandating internal controls over financial reporting (ITGC).

5. Cloud, IoT & OT

API - Application Programming Interface. Contract between two software components, often REST + JSON over HTTPS.

AWS - Amazon Web Services. Largest public cloud - EC2, S3, IAM, Lambda, plus 200+ ancillary services.

CI/CD - Continuous Integration / Continuous Delivery. Pipeline that builds, tests, and deploys on every commit.

IAM - Identity and Access Management. Cloud-specific role/policy engine that governs every API call.

IoT - Internet of Things. Embedded, often headless devices (cameras, sensors, appliances) networked into a system.

K8s - Kubernetes. Container orchestrator with pods, services, deployments, RBAC, and a CIS Benchmark.

OT - Operational Technology. Industrial control - PLCs, RTUs, SCADA - that drives physical processes.

S3 - Simple Storage Service. AWS object store with buckets; public-bucket misconfigs are constant incidents.

SCADA - Supervisory Control and Data Acquisition. Industrial control layer for distributed plants, grids, pipelines.

SQL - Structured Query Language. Standard relational-DB query language - and the surface of SQLi attacks.

SSH - Secure Shell. Encrypted TCP protocol (default 22) for remote command-line and tunneled-file access.

TCP - Transmission Control Protocol. Connection-oriented, reliable L4 transport - 3-way handshake, sequence, ACK.

UDP - User Datagram Protocol. Connectionless L4 transport - no handshake, no retransmit; used for DNS.

VPC - Virtual Private Cloud. Isolated logical network inside a public cloud (AWS VPC, Azure VNet).

VPN - Virtual Private Network. Encrypted tunnel - site-to-site or remote-access - over an untrusted network.

6. Tools, Standards & CEH-Specific

ATT&CK - Adversarial Tactics, Techniques, and Common Knowledge. MITRE’s 14-tactic, post-compromise behaviour catalog.

DoD 8140 - DoD Cyber Workforce Qualification Program. Replaced DoD 8570; lists CEH as a baseline certification.

EC-Council - International Council of E-Commerce Consultants. The certifying body that owns and proctors the CEH.

Kill Chain - Lockheed Martin 7-phase intrusion model: Recon, Weaponize, Deliver, Exploit, Install, C2, Actions.

NIST 800-115 - NIST SP 800-115, Technical Guide to Information Security Testing & Assessment. US pen-test methodology.

OSSTMM - Open Source Security Testing Methodology Manual. ISECOM’s peer-reviewed methodology; ROE template of record.

PTES - Penetration Testing Execution Standard. 7-section industry-standard pen-test methodology (Pre-eng → Report).

Alphabetical Index

AAA → Authentication, Authorization, and Accounting · AES → Advanced Encryption Standard · API → Application Programming Interface · APT → Advanced Persistent Threat · ATT&CK → Adversarial Tactics, Techniques, and Common Knowledge · AV → Antivirus · AWS → Amazon Web Services

BEC → Business Email Compromise · BFA → Brute Force Attack

CA → Certificate Authority · CBC → Cipher Block Chaining · CCPA → California Consumer Privacy Act · CI/CD → Continuous Integration / Continuous Delivery · CIS → Center for Internet Security · CMMC → Cybersecurity Maturity Model Certification · C2 → Command and Control · CRL → Certificate Revocation List · CSA → Cloud Security Alliance · CSRF → Cross-Site Request Forgery · CTR → Counter Mode · CVE → Common Vulnerabilities and Exposures · CVSS → Common Vulnerability Scoring System · CWE → Common Weakness Enumeration

DDoS → Distributed Denial of Service · DH → Diffie-Hellman · DoD 8140 → DoD Cyber Workforce Qualification Program · DoS → Denial of Service

EC-Council → International Council of E-Commerce Consultants · ECC → Elliptic Curve Cryptography · ECDH → Elliptic Curve Diffie-Hellman · ECDSA → Elliptic Curve Digital Signature Algorithm · EDR → Endpoint Detection and Response

GCM → Galois/Counter Mode · GDPR → General Data Protection Regulation

HIDS → Host Intrusion Detection System · HIPAA → Health Insurance Portability and Accountability Act · HMAC → Hash-based Message Authentication Code · HSM → Hardware Security Module

IAM → Identity and Access Management · IDS → Intrusion Detection System · IoT → Internet of Things · IPS → Intrusion Prevention System · IR → Incident Response · ISO → International Organization for Standardization · IV → Initialization Vector

K8s → Kubernetes · Kill Chain → Lockheed Martin 7-phase intrusion model

LLMNR → Link-Local Multicast Name Resolution

MD5 → Message Digest 5 · MFA → Multi-Factor Authentication · MITRE → Body maintaining CVE/CWE/ATT&CK

NAC → Network Access Control · NGFW → Next-Generation Firewall · NIST → National Institute of Standards and Technology · NIST 800-115 → NIST SP 800-115 Technical Guide to Testing

OCSP → Online Certificate Status Check · OSSTMM → Open Source Security Testing Methodology Manual · OT → Operational Technology · OWASP → Open Worldwide Application Security Project

PCI DSS → Payment Card Industry Data Security Standard · PDPA → Personal Data Protection Act · PGP → Pretty Good Privacy · PKI → Public Key Infrastructure · PTES → Penetration Testing Execution Standard

RASP → Runtime Application Self-Protection · RBAC → Role-Based Access Control · RCE → Remote Code Execution · ROP → Return-Oriented Programming · RSA → Rivest-Shamir-Adleman

S/MIME → Secure / Multipurpose Internet Mail Extensions · S3 → Simple Storage Service · SCADA → Supervisory Control and Data Acquisition · SHA → Secure Hash Algorithm · SIEM → Security Information & Event Management · SOAR → Security Orchestration, Automation & Response · SOC → Security Operations Center · SOX → Sarbanes-Oxley Act · SQL → Structured Query Language · SSH → Secure Shell · SSRF → Server-Side Request Forgery

TCP → Transmission Control Protocol

UDP → User Datagram Protocol

VPC → Virtual Private Cloud · VPN → Virtual Private Network

WAF → Web Application Firewall

X.509 → ITU-T Public Key Certificate Standard · XDR → Extended Detection & Response · XSS → Cross-Site Scripting · XXE → XML External Entity