2026-09-26
Software Security Glossary: 64 Essential Terms Explained
Security conversations move fast and lean heavily on acronyms: a design review mentions SSRF, a pen-test report scores findings with CVSS, an auditor asks for your SBOM. This glossary collects 64 of the terms that come up most often when building and shipping software, grouped into eight categories and each explained in plain English in a sentence or two.
How to use this glossary
Pick a category to narrow the list, or search across every term and definition at once. Each card starts collapsed: tap or click a term to read its definition, or use Expand all to open everything currently shown.
Showing 64 of 64 terms. Tap a card to read its definition.
Authentication & Access Control
Proving who you are to a system, usually with something you know (a password), have (a phone or key), or are (a fingerprint).
Deciding what an already-authenticated user is allowed to do. Authentication answers "who are you?"; authorization answers "are you allowed to do this?"
Requiring two or more independent proofs of identity, such as a password plus a one-time code. A stolen password alone is then no longer enough to log in.
Logging in once with a central identity provider and being trusted by many apps. It cuts down on password reuse and gives one place to revoke access.
A standard for letting one app access your data in another app without handing over your password, using limited, revocable access tokens instead.
An identity layer on top of OAuth 2.0 that tells an app who the user is, via a signed ID token. It powers most "Sign in with…" buttons.
Granting permissions to roles (like "admin" or "viewer") and assigning users to roles, rather than managing permissions person by person.
Giving every user, service and process only the access it needs to do its job, and no more. It limits the damage when any one of them is compromised.
Cryptography
Scrambling data with a key so that only someone holding the right key can turn it back into readable form.
Encryption where the same secret key locks and unlocks the data. It's fast (AES is the common example), but both sides must share the key safely.
Encryption using a key pair: anyone can encrypt with the public key, but only the private key can decrypt. It solves the problem of sharing a secret key with strangers.
A one-way function that turns any input into a fixed-length fingerprint. The same input always gives the same hash, but you can't reverse a hash back into the input.
A random value added to each password before hashing, so identical passwords produce different hashes and precomputed "rainbow table" attacks stop working.
The protocol behind the padlock in HTTPS. It encrypts traffic between two parties and uses certificates to prove the server is who it claims to be.
A value created with a private key that anyone can check with the matching public key. It proves who signed something and that it hasn't been altered since.
Everything involved in generating, storing, rotating and retiring cryptographic keys. Strong encryption is only as safe as the key protecting it.
Web Security
Injecting malicious script into a web page that other users then run in their browsers. It's prevented by encoding output and not trusting user-supplied HTML.
Sneaking database commands into input that an app pastes straight into a SQL query. Parameterised queries stop it by keeping data and code separate.
Tricking a logged-in user's browser into sending an unwanted request, like a transfer, to a site that trusts it. Anti-CSRF tokens and SameSite cookies defend against it.
Getting a server to make requests to a URL the attacker chooses, often reaching internal systems or cloud metadata endpoints that should never be exposed.
Browser rules, set by server headers, that control which other websites may read a site's responses. A too-permissive CORS policy can leak private data.
A response header that tells the browser which sources of scripts, styles and other content are allowed, blunting XSS even when an injection slips through.
Hiding a real page inside an invisible frame so a user's click lands on a button they never meant to press. Frame-blocking headers prevent it.
An access-control bug where changing an ID in a URL or request (say, /invoices/1042 to /1043) returns someone else's data because ownership is never checked.
Network Security
A filter that allows or blocks network traffic based on rules about where it's coming from, where it's going and which ports or protocols it uses.
An encrypted tunnel between a device and a network, so traffic crossing an untrusted network like public Wi-Fi can't be read or tampered with.
Flooding a service with traffic from many machines at once until real users can't reach it. It's usually absorbed by CDNs and dedicated mitigation services.
An attacker secretly sitting between two parties, reading or altering what they send each other. Properly verified TLS is the main defence.
A model that never trusts a request just because it comes from inside the network. Every user, device and request is verified every time.
An Intrusion Detection System watches traffic for signs of attack and raises alerts; an Intrusion Prevention System goes further and blocks it automatically.
Splitting a network into isolated zones so a breach in one area, like guest Wi-Fi, can't spread freely to sensitive systems like databases.
Feeding false DNS answers so a domain name resolves to an attacker's server instead of the real one. DNSSEC and encrypted DNS help prevent it.
Malware & Threats
Any software written to harm, spy on or take control of a system without the owner's consent. Viruses, worms, spyware and ransomware are all malware.
Malware that encrypts a victim's files, and often steals them too, then demands payment to restore access. Tested offline backups are the best insurance.
Fake emails, messages or websites that impersonate someone trusted to trick people into giving up passwords, money or access.
Malware disguised as legitimate software, so the victim installs it themselves. Once running, it opens the door for other attacks.
A vulnerability attackers know about before the vendor has a fix, leaving defenders "zero days" to prepare. Layered defences matter most here.
Manipulating people rather than systems, using urgency, authority or helpfulness to get someone to bypass a security control on the attacker's behalf.
Compromising a trusted third party, like an open-source package, build tool or vendor update, to reach every organisation that depends on it.
A well-resourced attacker, often state-backed, who breaks in quietly and stays hidden for months to steal data over time rather than cause immediate damage.
Data Protection
Any data that can identify a specific person, alone or combined with other data: names, emails, phone numbers, government IDs, even IP addresses in some laws.
Labelling data by sensitivity (such as public, internal, confidential, restricted) so each level gets the right amount of protection.
Encrypting data where it's stored, on disks, databases and backups, so a stolen drive or leaked snapshot is unreadable without the key.
Encrypting data while it moves between systems, usually with TLS, so it can't be read or changed by anyone watching the network.
Hiding parts of sensitive values, like showing only the last four digits of a card, so people and test environments see only what they need.
Swapping a sensitive value, such as a card number, for a meaningless token and storing the real value in a separate, locked-down vault.
Tools and policies that spot sensitive data leaving where it should be, through email, uploads or USB drives, and block or flag it.
Keep three copies of important data, on two different types of storage, with one copy offsite or offline, so no single failure or attack wipes everything.
Compliance & Standards
A regularly updated list of the most critical web application security risks, published by the Open Worldwide Application Security Project and widely used as a baseline.
A public catalogue that gives each known vulnerability a unique ID (like CVE-2021-44228) so everyone can refer to the same issue unambiguously.
A 0–10 score for how severe a vulnerability is, based on things like how easy it is to exploit and what an attacker gains. It helps teams decide what to patch first.
The EU's General Data Protection Regulation, which governs how personal data about people in the EU is collected, used and protected, with heavy fines for breaches.
The Payment Card Industry Data Security Standard: required security controls for any organisation that stores, processes or transmits card payment data.
An independent audit report showing how a service provider protects customer data across security, availability, confidentiality and related criteria.
An international standard for running an Information Security Management System (ISMS): a documented, audited process for managing security risk.
A widely adopted US framework that organises security work into core functions (Govern, Identify, Protect, Detect, Respond and Recover) to help teams assess and improve.
Tools & Practices
Scanning source code for security flaws without running it, often in the IDE or CI pipeline, so bugs are caught before they ship.
Testing a running application from the outside, the way an attacker would, by sending crafted requests and watching how it responds.
Checking an app's third-party and open-source dependencies against databases of known vulnerabilities and licence issues. Dependabot and npm audit are examples.
An authorised, simulated attack by security professionals to find and prove real weaknesses before criminals do.
Systematically asking "what could go wrong?" during design: mapping how a system could be attacked and deciding which defences to build in.
A platform that collects logs from across an organisation, correlates them and raises alerts, giving a security team one place to spot and investigate incidents.
Storing API keys, passwords and certificates in a dedicated vault with access control and rotation, instead of hard-coding them in source or config files.
A machine-readable inventory of every component and dependency in a piece of software, so you can quickly tell whether a newly disclosed vulnerability affects you.
None of these terms is hard on its own; the difficulty is that they arrive all at once. Learn the vocabulary first and the rest of security (threat models, audit findings, incident write-ups) gets much easier to follow. For the risks behind many of these words, see the OWASP Top 10:2025 breakdown.