Transcription
BISHOP FOXCYBERSECURITY STYLE GUIDEVERSION 1FEBRUARY 15, 2018
Bishop Fox Contact Information: 1 (480) 621-8967style@bishopfox.com8240 S. Kyrene RoadSuite A-113Tempe, AZ 85284Contributing Technical Editors:Brianne Hughes, Erin Kozak, Lindsay Lelivelt, Catherine LuWe want to thank all of our Bishop Fox consultants, especially Dan Petro, for reviewing andimproving the guide’s technical content.Bishop Fox 2018/02/152
TABLE OF CONTENTSWelcome! . 4Technical Formatting .5What to Expect in the Guide .6The Cybersecurity Style Guide . 7A-Z .7Appendix A: Decision-making Notes . 86How We Choose Our Terms .86How To Codify Your Own Terms .87Appendix B: External Resources . 88Epilogue. 92Bishop Fox 2018/02/153
WELCOME!We are Bishop Fox, a global information security consulting firm based in the United States.Welcome to our cybersecurity style guide. We compiled this guide to keep ourselvestechnically accurate and up to date in our reports, presentations, and social mediainteractions. Now we want to share this version of our standards with you.This guide is designed for security researchers. It provides advice on which words to use inreports, how they should look in the middle of a sentence, and how to pronounce them outloud. Since the terms are listed alphabetically, you’ll find serious usage advice right next toplayful entries about internet culture.Each term in the guide earned its place by being unintuitive in some way: It may look like a non-technical word (execute, pickling, shell), It may be uniquely written (BeEF, LaTeX, RESTful), It may not follow a clear pattern (web page vs. website), It may have a very specific technical distinction (invalidated vs. unvalidated), Or its meaning may change depending on the context (crypto, PoC, red teaming).Language is always evolving, and those changes are especially visible in an innovative fieldlike information security. This guide aspires to record those changes in vocabulary andencourage researchers to use language intentionally as the digital lexicon continues togrow. Learn more about what guides our style choices in Appendix A.This is a work in progress. We intend to revise this list in the future and share subsequentversions with the public. Please contact style@bishopfox.com with ideas about newentries or improvements to existing entries.N OT EThis guide is a starting point for further research into technical terms, not a comprehensivedictionary. We provide usage notes about capitalization, fonts, and pronunciation whereneeded, but not every term here is defined. External resources with detailed technicaldefinitions can be found in Appendix B.Bishop Fox 2018/02/154
Technical FormattingWe use two fonts. Most of our text appears in Open Sans (this sans serif font). We refer toOpen Sans in the style guide as the normal font. The secondary font is Source Code Pro, amonospace (fixed-width) font that we refer to throughout this guide as the tech font.The tech font makes technical terms stand out to the reader when they appear in and outof quoted code. We use the tech font for several reasons in several ways. Even with thechart below, we’re still finding gray areas. Here is an overview of how we use these fonts:Normal FontTech FontTitles of documents and file typesFull names of documents and filesSecurity Style Guide.pdfBishop Fox Security Style Guide, a PDF fileError messages and security questionsFile pathsserver/web/directory/“Please enter a valid user ID.”Names of organizations, companies, and teamsDEF CON, .NET, Tor, assessment teamNames of products and their versionsEmail addressesstyle@bishopfox.comUsernames and passwordsEthernet, Steam, Ubuntu 17.04Types of requests@bishopfox, admin:admin, passwordURIs and URLsGET request, pull request, PUT requestPorts by themselvesdata:, www.bishopfox.com/[variable]IP addresses (with or without ports)port 80, port 443Types of fields, headers, parameters, etc.192.168.1.1, 192.168.1.1:80Names of fields, headers, parameters, etc.data element, content-type headerLine numbersC: drive, Secure flag, url parameterQuoted code“On line 42 of the code excerpt ”Vulnerability IDsCVE-2014-6271, MS15-034, RFC 1918“Block [\n] and [?] characters”Code excerpts b Hello World! /b 3. Go to 1Terms that use the tech font appear in that style no matter where they show up in a report,including bullet points and figure captions.Bishop Fox 2018/02/155
Bold TextWhen writing about clickable buttons in reports, we follow the Microsoft Manual of Style(see Appendix B). We bold button names that the reader is meant to click. When writingabout a feature with the same name as a button, capitalize it if applicable, but don’t bold it. Click Track Changes to show all your future changes in Word. The Track Changes feature allows users to track their edits. After hitting the OK button, the user was redirected to the Home tab.Within the style guide word list, bolding indicates that a related term has its own entry.What to Expect in the GuideEach headword appears in either normal or tech font and is capitalized as it would appearin the middle of a sentence. For example:denial of service (n.), denial-of-service (adj.) (DoS)A denial of service is caused by denial-of-service attacks. Spell out on first use. DoS ispronounced as “doss” or spoken as the whole phrase, not the acronym.Related: DDoSSome entry headings clarify parts of speech: (adj.) for adjective, (n.) for noun, (v.) for verb.Many security terms have disputed pronunciations because they were typed first and thenspoken out loud later. Pronunciation is provided for select terms in the guide. Be awarethat some acronyms look similar but are pronounced differently:CIO is pronounced as letters, but CISO is pronounced as “seeso.”UI is pronounced as letters, but GUI is pronounced as “gooey.”PoC is pronounced as letters, but T-POC is pronounced as “tee-pock.”OSINT is pronounced “O-S-int” but OWASP is pronounced ”oh-wasp.”By combining the use of two fonts, button bolding, and the big word list below, we strive tobe accurate, consistent, and understandable to our clients. It’s been helping us internallyand we hope it helps you now, too.Bishop Fox 2018/02/156
THE CYBERSECURITY STYLE GUIDEA-Z!2FA or TFAThe exclamation point or bang.Two-factor authentication.Related: MFA@The at sign.3DESRelated: email, handle, usernameTriple DES. A symmetric key block cipher.DES is pronounced as letters or “dez.”#The pound sign or hashtag. Only called3D printinghashtag when tagging something. This3G, 4Gcharacter and [ ] are sometimes usedinterchangeably and are pronounced asThird- and fourth-generation“sharp” in programming language names.communications technology. Cell phoneRelated: C , characters, numbers, tweetnetwork options. Do not spell out.Related: CDMA, GSM/Slash. Avoid using the slash to compare two3Scalethings outside of set phrases like 24/7,An API management platform.and/or, client/server, h/t, and TCP/IP.Related: mm/dd/yyyy, s/o, SSL/TLS4chanA website for trolls and memes that birthed\Anonymous and rickrolling.Backslash.'Tic character. Not an apostrophe.0-day (n. or adj.)A “zero-day” or “oh-day” finding. In formalRelated: dox, message board, NSFW, troll7-ZipAn open source file archiver.8.3 filenameRelated: short-namewriting, it’s better to use zero-day finding,previously undisclosed vulnerability, or8-bit (adj.)publicly undisclosed vulnerability.2600A hacker magazine founded in 1984. Also aseries of local clubs. https://www.2600.com/Bishop Fox 2018/02/157
Aaccess point (AP)Spell out on first use.ACEArbitrary code execution. Spell out on firsta vs. anuse.Use “an” when the next word begins with avowel sound when spoken, regardless ofACL, ACLsspelling. A hybrid test. A unified problem.Access control list. Spell out on first use.A Xerox machine. An HTTP issue. An SSHtunnel. An underlying cause. An XSS attack.ADActive directory. Spell out on first use.a11yAccessibility, often in relation to technology.11 represents the 11 letters removed fromadb or adbAlso called the Android debugger, adb isthe middle of the word.both a command and a technology forRelated: i18n, L10n, k8sinteracting with an Android phoneconnected to a computer.abort (v.)Avoid using the verb unless it’s in quotedad blocking (n.), ad-blocking (adj.)code. Try force quit or interrupt instead.add on (v.), add-on (n.)abuse (n.)address barThis is acceptable in common industryphrases like “application abuse.” Avoidusing it on its own if possible. Try “maliciousad hoc (adj.)Describes immature security infrastructure.use or usage” instead.In networks (especially wireless ones),abuse (v.)OK in set phrases but do not use it on itsown. Try alter, automate, compromise,ad hoc means decentralized.admin or admindeface, exhaust, exploit, force,Short for administrator. Write in normalimpersonate, manipulate, misuse, reusetext if referring to the role or adminindefinitely, take advantage of, or a moreprivileges. If referring to the usernamespecific verb instead.admin, use tech font.-accessible (adj.)adversaryDo not use this term in formal writing; useAlways hyphenate.attacker or malicious user instead.Bishop Fox 2018/02/158
AESa.m.Advanced Encryption Standard. Spell out onPut a space after the number as in “4 a.m.first use.GMT.” Include the time zone if referring to atesting window or specific event.Agile processAmazon EC2, Amazon ECR, Amazon RDSRelated: scrum, sprintWeb services. After first use, you can referAIto the services by name without “Amazon.”Artificial intelligence, often used as jargonto refer to a computer program. AI can alsomean Amnesty International.analogand/orRelated: Deep Blue, HAL 9000, machineUse sparingly in formal writing.learning, replicants, The Three Laws ofRobotics, Turing Test, Watson, WOPRAndroidGoogle’s mobile operating system.Airbnbandroid (n.)air-gapped (adj.)Air-gapped systems are disconnected frominsecure networks and the internet.angle bracketsThe and characters.Related: charactersAkanaAn API management provider.AngularJSA JavaScript framework.alert boxAlexaAnimojiAnimated emoji created by Apple.Amazon AI.Related: Cortana, Google Assistant, Sirialgorithm (n.)anonymizationAnonymousInternational group of 4chan hacktivistsalphanumeric (adj.)with a Guy Fawkes mask symbol.Describes strings that contain letters andnumbers, not special characters,punctuation, or spaces.anti-malwareantivirus (AV)Apache ServerBishop Fox 2018/02/159
Aperture Sciencearbitrary (adj.)A fictional research company from theOf the attacker’s choosing, as in “the userPortal series of video games.would be redirected to an arbitrary URL.”API, APIsArcherShort for application programmingAn animated spy TV show that inspired theinterface. How software interacts with othername of the Bishop Fox Danger Drone. It’ssoftware. Do not spell out.also the name of an RSA security product.app vs. applicationArduino (n.)Smart devices like phones and tablets haveapps, computers have applications. App canalso be a shortened form of application. ToPronounced “ar-dweeno.”ARMthe security industry, they are all computerShort for Architecture Reference Manual orprograms.it can refer to RISC architecture used inmicroprocessors. Define briefly on first useAppleto clarify your intended meaning.Related: FaceTime, FairPlay, iOS, iPhone,Lightning cables, MAC OSX,macOS-based, PowerBook, Siriartificial intelligence (AI)ASCIIPronounced “ask-ee.”applet (n.)ASLRApple TVAddress space layout randomization.application securitySpell out on first use.Alternate term for information security.ASP.NETAPTassetShort for application penetration testing.Also stands for advanced persistent threatAssets are systems, software, applications,or advanced packaging tool. Spell out onlibraries, personnel, equipment, or anythingfirst use in public-facing documents.else that clients value and want to protect.Related: criticality, EPT, IPT, pen testingASVApproved scanning vendors. Spell out onARAugmented reality.first use.Related: IoT, VR, VuforiaRelated: PCIBishop Fox 2018/02/1510
ATMautocorrect (n. or v.)Short for automated teller machine or “atA generic term for an application featurethe moment.” “ATM machine” is redundant.that fixes identified mistakes in typedRelated: PIN, SSNwords.at-rest (adj.), at restautofillAt-rest encryption. Data at rest.automationattack chainThe automatic operation of requiredRelated: elevation of privilegesprocesses.attacker-controlled (adj.)auto-renew (v.)attacker-owned (adj.)avatarattack surface (n.)AWSAmazon Web Services.attributeBA specification of a value. When writingabout a type of attribute, use normal font.When discussing a specific attribute, usetech font as in “a username attribute."backdoor (n. or v.)audio conference, audio conferencingRelated: videoconferencingback end (n.), back-end (adj.)audit trailsbackported (adj.), backporting (n. or v.)AUPAcceptable Use Policy. Spell out on first use.backtraceauthenticationRelated: tracebackauthorization bypassback up (v.), backup (n. or adj.)autocomplete (n. or v.)backwards compatibility (n.)A generic term for an application featurethat predicts the rest of the word or phraseas a user types.Bishop Fox backslash or \backwards compatible (adj.)2018/02/1511
BCC, BCC’d, BCCingbadputRelated: goodput, throughputBlind carbon copy. Do not spell out.Related: CC, emailbandwidthBCPThe speed of a data network. “Neverunderestimate the bandwidth of a stationBusiness continuity plan. Spell out on firstwagon full of tapes hurtling down theuse.highway.” – Andrew Tanenbaumbcryptbank dropsPronounced “bee-crypt.” A passwordhashing function.barcodeBECbar mitzvah attackBusiness email compromise. Spell out onAn SSL vulnerability. So named because itsfirst use.security implications were realized 13 yearsRelated: phishingafter it first appeared in the codebase.Base64-encoded (adj.),Base64 encoding (n.)-based (adj.)BeEF, BeEF hookingBrowser Exploitation Framework.BERBit error rate. Spell out on first use.Always hyphenate.Ex: host-based, logic-based, role-basedbest practicesBusiness jargon, use sparingly. Practicesbaselinethat align with compliance guidelines orindustry standards.BashBASICA programming language.bastion hostRelated: CIS 20beta (n. or adj.)BFAn informal name for Bishop Fox. Used veryA specially hardened host often used as asparingly in places where space is limited.gateway to pivot into other hosts.BBSBGPBorder Gateway Protocol. Spell out on firstBulletin board system.Bishop Fox use.2018/02/1512
Big BrotherbitcoinThe symbol of totalitarian surveillance fromDigital cryptocurrency.the novel Nineteen Eighty-Four. Big BrotherRelated: coins vs. tokens, cold wallet,is watching you.hot wallet, securitiesbig databit-flipped (adj.), bit-flipping (adj.)big-endian (adj.)BitLockerMicrosoft Windows disk encryptionBIG-IPsoftware.A load balancer. Pronounced “big-eye-pee.”bitstreambillion laughs attackBitTorrentRelated: DoSbinaryBlackBerryBase-2 number system. 0 or 1. Can alsoblack-box testingrefer to binary executable files.Related: big-endian, little-endianBlack HatA series of annual security conferences thatBINDhappen in the USA, Europe, and Asia.A DNS server.https://www.blackhat.com/birds of a feather (BoF)black hatAn informal discussion group.An attacker or malicious user.birth dateblacklist (v. or n.), blacklistingBishop FoxRelated: blocklistOur company.Related: foxes, Lucius Fox, Martin Bishopblack marketWe prefer this term in formal reports tobit (n.), -bit (adj.)describe unindexed illegal online activityAs in “a key length of at least 2048 bits” orhubs. Tor and I2P are colloquially known as“a 2048-bit RSA key.” When abbreviated, use“dark web” browsers.lowercase b for bits, uppercase B for bytes.Related: fullz, I2P, TorBitbucketbleeding edge (n. or adj.)An Atlassian product for Git.Bishop Fox 2018/02/1513
blind (adj.)BMP file, .bmp fileDuring a blind attack, the attacker is unableto view the outcome of an action.Short for bitmap.BomgarbloatwareAn IT support portal.Boolean operatorsBLOB or blobBinary large object.Useful AND precise.blockchain, block chainingboot chain (n.)Related: CBC, cryptocurrencyRelated: start upblocklist, blocklistingboot time (n.)A proposed alternative term for blacklisting.Not yet widespread.Related: safelistBoston DynamicsbotAn automated program like a chatbot orblog, blogrollTwitterbot.BloodhoundbotnetA pen testing tool.A network of bots sometimes used inBlowfishransomware attacks.An encryption algorithm.Brainfuckblue screen (v.)An esoteric programming language.Blue Screen of Death (BSOD)breadcrumbs, breadcrumb trailblue team, blue teaming (v.)breakpoint (n. or v.)Blue teams run scenarios to defend a targetor environment from potential attackers.brickThey reduce the attack surface, employInformal. An old heavy cell phone or a deadhardening strategies, and use honeypots.device.Related: red team, purple teambrick-and-mortar (adj.)Describes IRL places of business.BluetoothA unifying wireless system named after aNorwegian king, Harald Bluetooth.Blu-rayBishop Fox browsable (adj.)browser fingerprinting2018/02/1514
browser hijackingBYODBring your own device. Describesbrute-force (v. or n.), brute-forcing (n.)companies that allow employees to usetheir own computers and phones for work.BSDBerkeley Software Distribution.bypass (v. or n.)A Unix-derived operating system.byproductBSidesbytesA global series of security events.http://www.securitybsides.com/Kilobytes, megabytes, gigabytes, terabytes,petabytes. KB, MB, GB, TB, PB. No spacebucketbetween number and unit as in 64TB. UseWhen discussing a type of bucket, useuppercase B for bytes, lowercase b for bits.normal font. When discussing a specificRelated: MiB, units of measurementbucket by name, use tech font for the nameCas in “an oz-provision bucket."buffer overflowbug bountyC A programming language. Pronounced asBugcrowd“C sharp.”A crowdsourced bug bounty securityRelated: #, hashtagcompany.built-in (adj.)CACertificate or certification authority. Spellbulleted (adj.)out on first use.Related: CEH, CISSPbullet point (n.)Burp Suite, Burp CollaboratorA web application proxy.business impact analysis (BIA)Spell out on first use.cache (n. or v.)cache bustingcache poisoningCactusConBuzzFeedAn annual security conference in Arizona.http://www.cactuscon.com/Bishop Fox 2018/02/1515
callback (adj. or n.)CCCAs in “a crafted callback parameter.”Chaos Communication Congress. An annualsecurity conference in Germany.CAMCCTVComputer-aided manufacturing. Spell outon first use.Closed circuit television.Related: LMSCD, CD-R, CD-ROM, CD-RWcanary accountCDMARelated: honeypotCode division multiple access.canonicalization, canonicalizeCDNCAPTCHA, CAPTCHAsContent delivery network. Spell out on firstuse.The Completely Automated Public Turingtest to tell Computers and Humans Apart.CDPA challenge-response test.Clean desk policy. Spell out on first use.Related: computer vision, reCAPTCHACEHcarriage return character or \rCertified Ethical Hacker.An invisible character that makes the textgo back to the beginning of the line. It’s acell phoneskeuomorph that refers to the waytypewriters need to “return” a carriage to itsoriginal position.certificateCFOcase-by-case (adj.)Chief Financial Officer.cash-out guideCGIShort for computer-generated images or,catch (v.)less commonly, Common GatewayRelated: throwInterface. Define briefly on first use toclarify your intended meaning.The Cathedral and the Bazaar (CatB)challenge-response mechanismsCBCRobot-filtering tests like CAPTCHA.Cipher block chaining. Spell out on first use.Related: Turing TestCC, CC’d, CCingCarbon copy. Do not spell out.changelogRelated: BCC, emailBishop Fox 2018/02/1516
ChromecastcharactersWhen calling out specific characterschroot(keystrokes) that affect the meaning of aChange root. A Unix operation thatcode sequence, use tech font surroundedsimulates a directory on a filesystem as if itby square brackets in normal font as inwere the root of the filesystem. Pronounced“added a single quote [‘].” If the character’sas “C-H-root” or “chuh-root.”name is also its symbol, write it in tech font.Related: chattr, chmodIf the font difference is not visible, usequotation marks as in 30,000 “A” characters.Related: metacharacters, wildcardschroot directory or ChrootDirectoryAn SSH directory.chatroomchroot jailA way to isolate a process from the rest ofchattrthe system.Short for change attribute. Pronounced as“chatter.”CIARelated: chmod, chrootShort for the Central Intelligence Agency orthe triad of information security concerns:checkbox (n.)confidentiality, integrity, and availability.check out (v.), checkout (adj. or n.)CIOchecksum, checksumsChief information officer.Related: CFO, CISOchild abuse materialcipherThis is a more accurate term for childpornography. If you discover child abuseDon’t use “cypher.” Write the names ofmaterial in the context of your work, reportciphers in normal font as in Blowfish.it to a manager immediately. If you find itRelated: RSA, SHAonline outside of work, quickly contactNCMEC—The National Center for Missingand Exploited Children.chmodChange mode. Pronounced as “changecipher suiteciphertextsCIS 20The Center for Internet Security has a list ofmod,” “C-H-mod,” or “chuh-mod.”20 guidelines for securing organizations.Related: chattr, chrootChromeGoogle browser.Bishop Fox 517
CIS CSCclickjackingCIS Critical Security Controls.In formal writing, we refer to this finding asRelated: CIS 20“user interface (UI) redress.” It’s also called“cross-frame scripting.”CISOclick through (v.)Chief Information Security Officer.Pronounced “seeso.”clickthrough (adj. or n.)CISSPclient-side (adj.)A security certification. CertifiedInformation Security Systems Professional.classclip artClippyWhen discussing a specific class by name,Discontinued anthropomorphic paper clipuse tech font as in “a Time class."assistant in Microsoft Office.cleartext vs. plaintextclosed caption (n.), closed-caption (adj.)In common usage, these terms are usedinterchangeably. In our reports, cleartextmeans unencrypted content. Plaintext is athe cloudBusiness jargon. “The cloud” is just servers.more technical term that describes theinput to a cryptographic system (which itselfmay already be encrypted or hashed).Related: CPAcloud computingCloudFrontAn AWS content delivery network (CDN).clear web or Clear WebThis is used in contrast to the “dark web” or“dark net” parts of the internet. It refersCloudTrailAn AWS logging and monitoring service.vaguely to publicly accessible sites thathave been indexed by search engines.Do not use in formal writing.CLIShort for command-line interface orcluster (n.)As in “provision a cluster on each account.”CMDBContent management database. Spell outcommand language interpreter. Spell outon first use.on first use.clickbaitCMSContent management system. Spell out onfirst use.Bishop Fox 2018/02/1518
co-creatorcommodity hardwareOver-the-counter hacking tools that anyonecode (n. or v.)could get and use.codebasecompany-wide (adj.)Related: user basecompensating controlscodeccompile (v.)Code/decode.Codecademycompliance frameworkcode pathcomputer vision (n.)code shrinkingconfiguration driftcoins vs. tokensconnect-back shell (n.)These are units of worth in virtualconstants (n.)currencies. These terms are sometimesused interchangeably and sometimes usedPre-defined variables that are referenced invery differently. Define briefly on first use tolater code.clarify your intended meaning.Related: bitcoin, cryptocurrencycold-call (v.) cold call (n.)A social engineering strategy.cold storage (n.)cold walletOffline bitcoin storage.containerizationcontent injectioncontent spoofingcontent type, Content-type header-controlled (adj.)Always hyphenate.Related: hot walletcommand and control (C2) machinecommand line (n.), command-line (adj.)commercial-free (adj.)Ex: attacker-controlled, user-controlledcookie (n.)cookie poisoning, cookie securitycooperate (v.)coordinate (v.)Bishop Fox 2018/02/1519
copycat (adj. or v.)criticalityRelated: spoofA measure of the degree to which anorganization depends on the information orcorrupted (adj.)information system for the success of amission or of a business function.CORSCross-origin resource sharing. Spell out oncronfirst use.Cron is a utility.Cortanacron job (n.)Microsoft AI.cross-platform (adj.)Related: Alexa, Google Assistant, Siricountermeasure (n.)cross-site scripting (XSS)There are three kinds of XSS:coworking spacereflected, stored, and DOM-based.CPACrowbarChosen-plaintext attack. Spell out on firstA password-cracking tool.use.crowdfund (v.)CPUcrowdsource (v.), crowdsourcing (n.)Central processing unit. Do not spell out.crack (v.)CRUDCreate, read, update, destroy.crawl (v.)cryptanalysis (n.), cryptanalytic (adj.)credential reuse (n.)cryptocredentials (n.)Historically, this was short for cryptography.The information necessary to pass aNow, it can also mean cryptocurrency. Spellsecurity check—often a username andout on first use to clarify your intendedpassword. Sometimes an RFID badge.meaning.critical (adj.)cryptocurrencyDescribes a non-negotiable businessVirtual currency.function or a vulnerability with catastrophicRelated: bitcoin, blockchain, coins vs.consequences that is easily exploitable.tokens, salami slicing attack, securitiescryptographicallyBishop Fox 2018/02/1520
CSPCupertino effectShort for Content Security Policy. Spell outAn error in early Apple dictionaries thaton first use.corrected “cooperation” to “Cupertino”because of their limited word list.CSPRNGcURLShort for Cryptographically SecurePseudo-Random Number Generator. APronounced “curl.”secure way of generating random numbers.Related: WgetSpell out on first use.currencyCSRFOur reports rarely include specific valuesShort for cross-site request forgery. Abut we default to USD as in 1.50. Follow APcommon vulnerability. Spell out on first use.style for mixed currency situations.CSSThe HTML cascading style sheets feature.Do not spell out.C-suite (adj. or n.)cursor (n.)custom-written (adj.)cutting edge (n.), cutting-edge (adj.)Related: bleeding edgeHigh-level executives like CEOs and CIOs.CSV file, .csv fileCVECommon Vulnerabilities and Exposures.Comma-separated value(s).A system that catalogs publicly knownCSWSHvulnerabilities and exposures. CVEThe cross-site WebSocket hijacking vuln.references are written in normal font as inSpell out on first use.CVE-2014-6271.CTFCVSSCapture the flag. Spell out on first use inCommon Vulnerability Scoring System. Spellpublic-facing documents.out on first use.CTOCWChief Technology Officer.CTRContent warning.CWEShort for clickthrough rate or CounterCommon Weakness Enumeration. WriteMode. Spell out on first use.weaknesses in normal font as in CWE-565.Related: CVEBishop Fox 2018/02/1521
DcyberIndustry professionals don’t use this prefix,but it’s helpful when informing the public,as in the title of this document. For manyusers, “cyber” on its own invokes cybersex,not hacking. https://willusingtheprefixcyberdaemonPronounced as “demon.” Describes amakemelooklikeanidiot.com/background system process on a computer.Related: cybersecurityDanger DronecyberpunkA Bishop Fox creation. It’s a Raspberry Pi onA subgenre of science fiction.a drone that can access tall buildingsinconspicuously as a flying hacker laptop.cybersecurityDefense contractors and governmentofficials use this term or “infosec.” IndustryDAOShort for decentralized autonomousprofessionals do not prefer this term, but itorganization or Data Access Object.is used for clarity with the public, as in theSpell out on first use.title of this document. We prefer the terminformation security.dark net or Dark NetRelated: cyber-, infosecThis nebulous term, along with “dark web”and “deep web,” are written and usedcyborginconsistently to refer to online blackA hybrid organic being. Coined in 1960 tomarkets. Better to call it the black market ormean cybernetic organism.specify the site or service in formal writing.Related: Tor, I2PCycriptA reverse engineering tool for iOS devices.Dark ReadingA security industry publication.CydiaAn app found on jailbroken iOS devices.DARPADefense Advanced Research ProjectsCylonAgency.Fictional cyborgs in Battlestar Galactica.dataAlways write data in the singular as in“the data was recovered.”data://Use tech font for data URIs.Bishop Fox 2018/02/1522
databasedead codeOK in formal writing.data centerdead dropsdata filesDebiandata handling (adj. and n.)A Linux distribution. Pronounced“debb-ean.”data-only (adj.)debuggable (adj.)datesBe aware of possible day/month confusiondecap (v.), decapped (adj.)with global audiences.declare (v.)Related: mm/dd/yyTo tell a program that a function existsdatetimebefore the function has been defined.day-to-day (adj.)decommed (adj. or v.)As in “day-to-day activities.”Use “decommissioned” in formal writinginstead.DBShort for database. Spell out on fir
Open Sans in the style guide as the normal font. The secondary font is Source Code Pro, a monospace (fixed-width) font that we refer to throughout this guide as the tech font. The tech font makes technical terms stand out to the reader when they appear in and out of quoted code. We use the tech font for several reasons in several ways. Even .
