nesbitt.io
The Infosec Phrasebook
Spend enough time around security people and you pick up a second vocabulary. It has a faintly military air and a noticeable per-syllable markup on vendor invoices.
_Defense in depth_ : coding.
_Zero trust_ : auth.
_Least privilege_ : the permissions you forgot to grant.
_Attack surface_ : your code.
_Blast radius_ : everyone else’s code.
_Hardening_ : turning things off.
_Air gap_ : a USB stick.
_Shift left_ : make it the developer’s problem.
_Threat model_ : a Google Doc.
_Tabletop exercise_ : a meeting about the Google Doc.
_Compensating control_ : we didn’t fix it.
_Risk acceptance_ : we didn’t fix it, in writing.
_Remediation_ : a Jira epic.
_Assume breach_ : we got breached.
_CVE_ : cirriculem vitae enhancement.
_CVSS 9.8_ : please answer the phone.
_Lateral movement_ : ssh.
_Exfiltration_ : curl.
_Supply chain security_ : running `npm install`, nervously.
_Security posture_ : vibes.
Then there’s _cyber_ , which gets prefixed to all of the above and increasingly used on its own. Cyber risk, cyber hygiene, cyber resilience, Cyber Essentials, “I work in cyber”. I have been on the internet long enough to remember when cyber was a verb, and what it meant when a stranger in an AOL chatroom asked if you wanted to. I cannot watch a minister say it into a microphone without that association firing, and at this point I’ve stopped expecting it to fade.
